CVE-2026-88420: XSS

Q: Which deployments are exposed?

Deployments using APSL puput versions 1.2.1 through 2.2.0 are affected when users have Wagtail Editor privileges.

Q: What access does an attacker need to exploit this issue?

An attacker must be authenticated and have Wagtail Editor privileges. They can use a crafted payload to trigger script execution in a victim's browser.

Q: What is the impact of successful exploitation?

Successful exploitation enables arbitrary code execution in the context of the victim's browser through reflected cross-site scripting.

Published Sep 25, 2026

Updated

A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload.

Affected Software

1 affected component

APSL puput>=1.2.1<=2.2.0

Event History

Sep 25, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which deployments are exposed?

Deployments using APSL puput versions 1.2.1 through 2.2.0 are affected when users have Wagtail Editor privileges.

What access does an attacker need to exploit this issue?

An attacker must be authenticated and have Wagtail Editor privileges. They can use a crafted payload to trigger script execution in a victim's browser.

What is the impact of successful exploitation?

Successful exploitation enables arbitrary code execution in the context of the victim's browser through reflected cross-site scripting.