CVE-2026-28223: Wagtail Cross-site Scripting Vulnerability in simple_translation Admin Interface
Summary
CVE-2026-28223: Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface. Affects wagtail across 4 version ranges.
< 6.3.8
>= 6.4rc1, < 7.0.6
>= 7.1rc1, < 7.2.3
>= 7.3rc1, < 7.3.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wagtail is an open-source content management system (CMS) built on Django, designed for managing and publishing content on websites. It offers a user-friendly interface, powerful features like page versioning, and a flexible architecture that allows developers to create custom content types. However, Wagtail's 'simple_translation' module has been found to be vulnerable to a stored Cross-site Scripting (XSS) attack, which can compromise user credentials and site security.
Vulnerability Detail
The vulnerability arises from the ability of an authenticated user to create a page with a specially-crafted title within the Wagtail admin area. When another user attempts to perform the 'Translate' action on this page, the malicious title can execute arbitrary JavaScript code. This XSS vulnerability can lead to unauthorized actions being performed with the affected user's credentials, posing a significant security risk to the application.
How To Fix
Latest published version: 8.0.1 as of 23 Oct 2026
pip install --upgrade "wagtail==8.0.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.3.86.3.8pip install --upgrade "wagtail==6.3.8" -
>= 6.4rc1, < 7.0.67.0.6pip install --upgrade "wagtail==7.0.6" -
>= 7.1rc1, < 7.2.37.2.3pip install --upgrade "wagtail==7.2.3" -
>= 7.3rc1, < 7.3.17.3.1pip install --upgrade "wagtail==7.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workarounds are available for this vulnerability. The only effective solution is to update to the patched versions mentioned above.
Conclusion
The Wagtail CMS has a vulnerability in its 'simple_translation' module that allows for stored XSS attacks. It is crucial for users with access to the Wagtail admin area to update to the latest patched versions to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for wagtail →
FAQ
The vulnerability is a stored Cross-site Scripting (XSS) issue that allows malicious JavaScript code to be executed in the context of another user's session.
Only authenticated users with access to the Wagtail admin area can exploit this vulnerability, making it less likely to be targeted by ordinary site visitors.
If exploited, this vulnerability can lead to unauthorized actions being performed on behalf of the affected user, potentially compromising sensitive data and site integrity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.1, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail.
