CVE-2020-15118: Cross-Site Scripting in Wagtail
Summary
CVE-2020-15118: Cross-Site Scripting in Wagtail. Affects wagtail across 2 version ranges.
< 2.7.4
>= 2.8rc1, < 2.9.3
Fixed in 2.7.4 or 2.9.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wagtail is an open-source content management system (CMS) built on Django, a high-level Python web framework. It provides a user-friendly interface for managing website content. The Wagtail CMS allows editors to create form pages using the wagtail.contrib.forms app. These form pages can be built using Django's standard form rendering helpers. However, a vulnerability exists in Wagtail versions 0 to 2.7.4 and 2.8.0 to 2.9.2, where HTML tags used within a form field's help text are rendered unescaped in the page. This can lead to a cross-site scripting (XSS) attack, potentially allowing privilege escalation.
Vulnerability Detail
The vulnerability arises due to the inclusion of HTML tags within form field help text, which is rendered unescaped in the page. While Django allows HTML in help text as an intentional design decision, Wagtail restricts editors from inserting arbitrary HTML to prevent XSS attacks. However, this functionality was inadvertently made available to editor-level users. Exploiting this vulnerability requires access to the Wagtail admin interface. An attacker could craft malicious help text containing JavaScript code, which would execute within the context of the victim's browser when the form page is viewed. This could lead to various consequences, including unauthorized access or data manipulation.
How To Fix
Latest published version: 8.0.1 as of 23 Oct 2026
pip install --upgrade "wagtail==8.0.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.42.7.4pip install --upgrade "wagtail==2.7.4" -
>= 2.8rc1, < 2.9.32.9.3pip install --upgrade "wagtail==2.9.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the patched versions is not feasible, a temporary workaround can be implemented by rendering forms field-by-field as per Django's documentation, but omitting the |safe filter when outputting the help text. This ensures that the HTML tags within the help text are escaped and not rendered as raw HTML.
Conclusion
The vulnerability in Wagtail versions 0 to 2.7.4 and 2.8.0 to 2.9.2 allows for potential cross-site scripting (XSS) attacks through unescaped rendering of HTML tags within form field help text. To mitigate this vulnerability, it is recommended to upgrade to the patched versions (2.7.4 or 2.9.3) or implement the provided workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for wagtail →
FAQ
Wagtail is an open-source content management system (CMS) built on Django, a Python web framework. It provides a user-friendly interface for managing website content.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized access, data theft, or other malicious activities.
An attacker with access to the Wagtail admin interface can craft form field help text containing malicious JavaScript code. When a victim views the form page, the JavaScript code will execute within their browser, potentially allowing the attacker to perform unauthorized actions or steal sensitive information.
No, only versions 0 to 2.7.4 and 2.8.0 to 2.9.2 of Wagtail are affected by this vulnerability. It is recommended to upgrade to the patched versions (2.7.4 or 2.9.3) to mitigate the risk.
By default, the patched versions of Wagtail escape HTML tags within help text to prevent potential XSS attacks. However, if site owners want to allow HTML within help text and accept the associated risk, they can set WAGTAILFORMS_HELP_TEXT_ALLOW_HTML = True in their configuration settings.
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail.
