wagtail has 22 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 10 in the last 90 days against 0 in the 90 before. The busiest recent month was August 2026 with 10. The median CVSS is 5.7 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-280 (8).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.7
- Publish → KEV
- —
- Last 90 days
- 10 prev 0
Worst active — by depth score
CVE-2026-54263High· 7.3Wagtail: Reflected XSS in dynamic image URL generator view40GHSA-x5cx-w6p2-mxf2Medium· 6.5Wagtail: Improper permission handling when copying snippets36GHSA-jm5p-837g-rv8gMedium· 6.5Wagtail: Improper restriction handling on Page translation API endpoint36CVE-2026-54261Medium· 6.5Wagtail: Improper permission handling in image preview36CVE-2023-28836Medium· 6.4Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views35
wagtail vulnerabilities
CVEs affecting wagtail, newest first. Open any entry for full detail, references, and exploit status.
22 CVEsRSS
CVE-2026-55468Medium· 4.3Wagtail is an open source content management system built on Django
Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without suf…
CVE-2026-54259Medium· 4.3Wagtail: Improper restriction handling on Documents and Images chosen endpoints
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
CVE-2026-54260Medium· 4.3Wagtail: Denial of service via unbounded filter specs in the image preview
Wagtail: Denial of service via unbounded filter specs in the image preview
CVE-2026-54261Medium· 6.5Wagtail: Improper permission handling in image preview
Wagtail: Improper permission handling in image preview
CVE-2026-54262Medium· 4.3Wagtail: Pages translations can be created without page permissions when using simple_translation
Wagtail: Pages translations can be created without page permissions when using simple_translation
CVE-2026-54263High· 7.3Wagtail: Reflected XSS in dynamic image URL generator view
Wagtail: Reflected XSS in dynamic image URL generator view
GHSA-92hv-j533-69wcLow· 3.7Wagtail: Identification of documents by SHA1 hash
Wagtail: Identification of documents by SHA1 hash
GHSA-c2xx-cjmh-9q8fMedium· 5.3Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
GHSA-x5cx-w6p2-mxf2Medium· 6.5Wagtail: Improper permission handling when copying snippets
Wagtail: Improper permission handling when copying snippets
GHSA-jm5p-837g-rv8gMedium· 6.5Wagtail: Improper restriction handling on Page translation API endpoint
Wagtail: Improper restriction handling on Page translation API endpoint
CVE-2026-28222Medium· 6.1Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes
Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes
CVE-2026-28223Medium· 6.1Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface
Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface
CVE-2026-25517MediumWagtail has improper permission handling on admin preview endpoints
Wagtail has improper permission handling on admin preview endpoints
CVE-2024-35228Medium· 5.5Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`
Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`
CVE-2024-32882Low· 2.7Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`
Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`
CVE-2023-28836Medium· 6.4Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
CVE-2023-28837Medium· 4.4Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files
Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files
CVE-2021-32681Medium· 5.4Cross-site Scripting in wagtail
Cross-site Scripting in wagtail
CVE-2021-29434Medium· 6.1Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
CVE-2020-15118Medium· 5.7Cross-Site Scripting in Wagtail
Cross-Site Scripting in Wagtail
CVE-2020-11037Medium· 6.1Potential Observable Timing Discrepancy in Wagtail
Potential Observable Timing Discrepancy in Wagtail
CVE-2020-11001Medium· 5.8Possible XSS attack in Wagtail
Possible XSS attack in Wagtail