wagtail vulnerabilities
CVEs whose affected-version data names the wagtail package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
22 CVEsRSS
CVE-2026-55468Medium· 4.3Wagtail is an open source content management system built on Django
Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without suf…
CVE-2026-54259Medium· 4.3Wagtail: Improper restriction handling on Documents and Images chosen endpoints
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
CVE-2026-54260Medium· 4.3Wagtail: Denial of service via unbounded filter specs in the image preview
Wagtail: Denial of service via unbounded filter specs in the image preview
CVE-2026-54261Medium· 6.5Wagtail: Improper permission handling in image preview
Wagtail: Improper permission handling in image preview
CVE-2026-54262Medium· 4.3Wagtail: Pages translations can be created without page permissions when using simple_translation
Wagtail: Pages translations can be created without page permissions when using simple_translation
CVE-2026-54263High· 7.3Wagtail: Reflected XSS in dynamic image URL generator view
Wagtail: Reflected XSS in dynamic image URL generator view
GHSA-92hv-j533-69wcLow· 3.7Wagtail: Identification of documents by SHA1 hash
Wagtail: Identification of documents by SHA1 hash
GHSA-c2xx-cjmh-9q8fMedium· 5.3Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
GHSA-x5cx-w6p2-mxf2Medium· 6.5Wagtail: Improper permission handling when copying snippets
Wagtail: Improper permission handling when copying snippets
GHSA-jm5p-837g-rv8gMedium· 6.5Wagtail: Improper restriction handling on Page translation API endpoint
Wagtail: Improper restriction handling on Page translation API endpoint
CVE-2026-28222Medium· 6.1Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes
Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes
CVE-2026-28223Medium· 6.1Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface
Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface
CVE-2026-25517MediumWagtail has improper permission handling on admin preview endpoints
Wagtail has improper permission handling on admin preview endpoints
CVE-2024-35228Medium· 5.5Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`
Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`
CVE-2024-32882Low· 2.7Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`
Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`
CVE-2023-28836Medium· 6.4Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
CVE-2023-28837Medium· 4.4Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files
Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files
CVE-2021-32681Medium· 5.4Cross-site Scripting in wagtail
Cross-site Scripting in wagtail
CVE-2021-29434Medium· 6.1Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
CVE-2020-15118Medium· 5.7Cross-Site Scripting in Wagtail
Cross-Site Scripting in Wagtail
CVE-2020-11037Medium· 6.1Potential Observable Timing Discrepancy in Wagtail
Potential Observable Timing Discrepancy in Wagtail
CVE-2020-11001Medium· 5.8Possible XSS attack in Wagtail
Possible XSS attack in Wagtail