CVE-2026-54263: Wagtail Reflected XSS Vulnerability in Dynamic Image URL Generator
Summary
CVE-2026-54263: Wagtail is an open source content management system built on Django. Affects wagtail across 2 version ranges.
>= 7.3, < 7.3.3
>= 7.4, < 7.4.2
Fixed in 7.3.3 or 7.4.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wagtail is an open-source content management system (CMS) built on the Django framework. It is designed to provide a flexible and user-friendly interface for managing website content. Wagtail allows users to create, edit, and organize content efficiently, making it a popular choice for developers and content editors alike. However, certain versions of Wagtail are vulnerable to a reflected cross-site scripting (XSS) attack, which can compromise user accounts and lead to unauthorized actions.
Vulnerability Detail
In versions prior to 7.0.8, 7.3.3, and 7.4.2, Wagtail contains a reflected XSS vulnerability in the dynamic image URL generator view within the admin interface. This vulnerability allows a user with limited permissions to craft a malicious URL that, when accessed by a user with higher privileges, can execute actions using that user's credentials. This issue is particularly concerning as it affects all sites using Wagtail, regardless of whether the dynamic image serve view is enabled. The vulnerability is not exploitable by ordinary site visitors without access to the Wagtail admin interface.
How To Fix
Latest published version: 8.0.1 as of 23 Oct 2026
pip install --upgrade "wagtail==8.0.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 7.3, < 7.3.37.3.3pip install --upgrade "wagtail==7.3.3" -
>= 7.4, < 7.4.27.4.2pip install --upgrade "wagtail==7.4.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched versions as indicated.
Conclusion
The reflected XSS vulnerability in Wagtail's dynamic image URL generator poses a significant risk to users with higher privileges. It is essential for users to update to the latest patched versions to protect against potential exploitation. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for wagtail →
FAQ
The vulnerability is a reflected cross-site scripting (XSS) issue that allows crafted URLs to execute actions on behalf of higher-privileged users.
Versions prior to 7.0.8, 7.3.3, and 7.4.2 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
While there are no specific workarounds, it is crucial to prioritize updating to a patched version as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail.
