CVE-2021-32681: Wagtail Cross-Site Scripting Vulnerability
Summary
CVE-2021-32681: Wagtail is an open source content management system built on Django. Affects wagtail across 3 version ranges.
< 2.11.8
>= 2.12, < 2.12.5
>= 2.13, < 2.13.2
Fixed in 2.11.8, 2.12.5 or 2.13.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wagtail is an open source content management system built on Django. It provides a user-friendly interface for managing website content and is widely used in web development projects. This vulnerability affects versions 2.13-2.13.1, 2.12-2.12.4, and versions prior to 2.11.8. It specifically impacts the {% include_block %} template tag when used to output plain-text StreamField blocks without a specified rendering template. Users with 'editor' access to the Wagtail admin can exploit this vulnerability to insert arbitrary HTML or scripting, potentially compromising the security of the system.
Vulnerability Detail
The vulnerability arises from the improper escaping of HTML in the output of the {% include_block %} template tag when used with plain-text StreamField blocks. This allows users with 'editor' access to inject arbitrary HTML or scripting into the rendered content. The impact of this vulnerability depends on the privileges of the affected user and the sensitivity of the website. It could potentially lead to cross-site scripting attacks, data leakage, or unauthorized access to sensitive information. The issue has been addressed in patched versions: Wagtail 2.11.8, Wagtail 2.12.5, and Wagtail 2.13.2.
How To Fix
Latest published version: 8.0.1 as of 23 Oct 2026
pip install --upgrade "wagtail==8.0.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.11.82.11.8pip install --upgrade "wagtail==2.11.8" -
>= 2.12, < 2.12.52.12.5pip install --upgrade "wagtail==2.12.5" -
>= 2.13, < 2.13.22.13.2pip install --upgrade "wagtail==2.13.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not feasible, site implementors can apply a workaround by reviewing their usage of {% include_block %} and ensuring it is not used to output CharBlock / TextBlock values without an associated template. In these cases, the tag can be replaced with Django's {{ ... }} syntax. For example, {% include_block my_title_block %} can be replaced with {{ my_title_block }}. This ensures that the output is properly escaped as HTML and mitigates the risk of cross-site scripting vulnerabilities.
Conclusion
In conclusion, Wagtail versions 2.13-2.13.1, 2.12-2.12.4, and versions prior to 2.11.8 are vulnerable to a cross-site scripting issue when using the {% include_block %} template tag. Upgrading to the patched versions or applying the suggested workaround will mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wagtail →
FAQ
Wagtail is an open source content management system built on Django. It provides a user-friendly interface for managing website content.
Versions 2.13-2.13.1, 2.12-2.12.4, and versions prior to 2.11.8 are affected by this vulnerability.
This vulnerability can be exploited by users with 'editor' access to the Wagtail admin.
The potential consequences include cross-site scripting attacks, data leakage, and unauthorized access to sensitive information.
To fix this vulnerability, it is recommended to upgrade to the latest patched versions of Wagtail: Wagtail 2.11.8, Wagtail 2.12.5, or Wagtail 2.13.2.
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail.
