PyPI/wagtail CVE-2026-28223: medium 6.1, EPSS 0.53%
Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface
Action: Upgrade wagtail to 6.3.8 or later.
pip install wagtail==6.3.8pip install wagtail==7.0.6pip install wagtail==7.2.3pip install wagtail==7.3.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.3.8 | - |
| 6.4rc1 | 7.0.6 | - |
| 7.1rc1 | 7.2.3 | - |
| 7.3rc1 | 7.3.1 | - |
Fixed versions
| 6.3.8 | 7.0.6 | 7.2.3 | 7.3.1 |
Sources
- osv: GHSA-p4v8-rw59-93cq
- https://github.com/wagtail/wagtail/security/advisories/GHSA-p4v8-rw59-93cq
- https://nvd.nist.gov/vuln/detail/CVE-2026-28223
- https://github.com/wagtail/wagtail/commit/1c6f2effed68f4ccad6fbd07987e03641505f863
- https://github.com/wagtail/wagtail/commit/ba70244d376a7b1bd180ded03e827917ff410c19
- https://github.com/wagtail/wagtail/commit/d8c5900982df8ed5938ad993aa9ff69cda50f80c
- https://github.com/wagtail/wagtail/commit/ee39d39deeb7f250fe886417b24802d7e05b1143
- https://github.com/wagtail/wagtail
- https://github.com/wagtail/wagtail/releases/tag/v6.3.8
- https://github.com/wagtail/wagtail/releases/tag/v7.0.6
- https://github.com/wagtail/wagtail/releases/tag/v7.2.3
- https://github.com/wagtail/wagtail/releases/tag/v7.3.1
CVE-2026-28223 · published · modified · JSON