CVE-2023-28836

2 advisories.

PyPI/wagtail CVE-2023-28836: medium 6.4, EPSS 0.78%

Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views

Action: Upgrade wagtail to 4.1.4 or later.

pip install wagtail==4.1.4

pip install wagtail==4.2.2

Affected

introduced	fixed	last affected
1.5	4.1.4	-
4.2	4.2.2	-

Fixed versions

4.1.4

4.2.2

Sources

osv: GHSA-5286-f2rf-35c2
https://github.com/wagtail/wagtail/security/advisories/GHSA-5286-f2rf-35c2
https://nvd.nist.gov/vuln/detail/CVE-2023-28836
https://github.com/wagtail/wagtail/commit/5be2b1ed55fd7259dfdf2c82e7701dba407b8b62
https://github.com/wagtail/wagtail/commit/bc84bf9815610cfbf8db3b6050c7ddcbaa4b9713
https://github.com/wagtail/wagtail/commit/eefc3381d37b476791610e5d30594fae443f33af
https://github.com/wagtail/wagtail/commit/ff806ab173a504395fdfb3139eb0a29444ab4b91
https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#customising-chooseparentview
https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview
https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2023-55.yaml
https://github.com/wagtail/wagtail
https://github.com/wagtail/wagtail/releases/tag/v4.1.4
https://github.com/wagtail/wagtail/releases/tag/v4.2.2

CVE-2023-28836 · published 2023-04-03T17:25:27Z · modified 2026-09-10T03:49:53.494353056Z · JSON

PyPI/wagtail CVE-2023-28836: unknown, EPSS 0.78%

Wagtail is an open source content management system built on Django. Starting in version 1.5 and prior to versions 4.1.4 and 4.2.2, a stored cross-site scripting (XSS) vulnerability exists on ModelAdm