CVE-2026-28223: Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface
Impact A stored Cross-site Scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simpletranslation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patches Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.
Workarounds None
Acknowledgements
Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.
For more information
If there are any questions or comments about this advisory:
- Visit Wagtail's support channels - Email Wagtail at security@wagtail.org (view the security policy for more information).
Other sources
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simpletranslation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28223?
CVE-2026-28223 is a stored Cross-site Scripting (XSS) vulnerability that can impact the security of affected users.
How do I fix CVE-2026-28223?
To fix CVE-2026-28223, upgrade to Wagtail version 7.3.1, 7.2.3, 7.0.6, or 6.3.8.
Which software is affected by CVE-2026-28223?
CVE-2026-28223 affects Wagtail versions prior to 6.3.8, 7.0.6, 7.2.3, and 7.3.1.
What kind of attack can CVE-2026-28223 enable?
CVE-2026-28223 can enable attackers to execute malicious scripts in the context of another user's session through the Wagtail admin interface.
Who can exploit CVE-2026-28223?
Any authenticated user with access to the Wagtail admin area can potentially exploit CVE-2026-28223 by creating maliciously crafted titles.