CVE-2021-44649: Django CMS Cross Site Scripting (XSS) Vulnerability
Summary
CVE-2021-44649: Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. Affects django-cms across 4 version ranges.
>= 3.4.0, < 3.4.7
>= 3.5.0, < 3.5.4
>= 3.6.0, < 3.6.1
>= 3.7.0, < 3.7.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Django CMS is a content management system built on top of the Django web framework. It provides a user-friendly interface for managing website content and allows developers to create and customize plugins. The vulnerability affects Django CMS version 3.7.3 and earlier. Django CMS does not properly validate the plugin_type parameter, which can lead to a Cross Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of an affected user.
Vulnerability Detail
The vulnerability in Django CMS arises from the lack of validation on the plugin_type parameter. When an invalid plugin type is provided, Django CMS generates error messages that are not properly sanitized. As a result, an attacker can inject malicious JavaScript code into the error message, which will be executed when viewed by a user. This can lead to various attacks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user.
How To Fix
Latest published version: 5.1.3 as of 23 Oct 2026
pip install --upgrade "django-cms==5.1.3"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.4.0, < 3.4.73.4.7pip install --upgrade "django-cms==3.4.7" -
>= 3.5.0, < 3.5.43.5.4pip install --upgrade "django-cms==3.5.4" -
>= 3.6.0, < 3.6.13.6.1pip install --upgrade "django-cms==3.6.1" -
>= 3.7.0, < 3.7.43.7.4pip install --upgrade "django-cms==3.7.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The Cross Site Scripting (XSS) vulnerability in Django CMS 3.7.3 and earlier allows attackers to execute arbitrary JavaScript code in the web browser of affected users. To mitigate this vulnerability, users should upgrade to Django CMS version 3.7.4 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django-cms →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of an affected user. This can lead to various attacks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user.
The vulnerability affects Django CMS version 3.7.3 and earlier. Users of these versions should upgrade to version 3.7.4 or later.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the recommended fix to prevent potential exploitation.
No specific workaround is provided for this vulnerability. Users are advised to upgrade to the latest version of Django CMS to mitigate the risk.
More information about this vulnerability can be found in the Django CMS advisory database: [link to advisory database]
Related vulnerabilities
Recent vulnerabilities recorded for django-cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
