{"action":"Upgrade wagtail to 2.7.4 or later.","affected":[{"fixed":"2.9.3","introduced":"2.8rc1"},{"fixed":"2.7.4","introduced":"0"}],"component":"wagtail","cve_ids":["CVE-2020-15118"],"ecosystem":"PyPI","epss":0.01101,"exploited":false,"fixed_versions":["2.9.3","2.7.4"],"ghsa_id":"GHSA-2473-9hgq-j7xw","id":"tcs_01M5KERP18KQ42QHCH9V7GHXZV","modified_at":"2026-09-10T03:48:51.827029851Z","published_at":"2020-07-20T17:50:30Z","references":["https://osv.dev/vulnerability/GHSA-2473-9hgq-j7xw","https://github.com/wagtail/wagtail/security/advisories/GHSA-2473-9hgq-j7xw","https://nvd.nist.gov/vuln/detail/CVE-2020-15118","https://github.com/wagtail/wagtail/commit/d9a41e7f24d08c024acc9a3094940199df94db34","https://docs.djangoproject.com/en/3.0/ref/models/fields/#django.db.models.Field.help_text","https://docs.wagtail.io/en/stable/reference/contrib/forms/index.html#usage","https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2020-154.yaml","https://github.com/wagtail/wagtail","https://github.com/wagtail/wagtail/blob/master/docs/releases/2.9.3.rst"],"severity":{"label":"medium","score":5.7},"sources":[{"source":"osv","source_id":"GHSA-2473-9hgq-j7xw","url":"https://osv.dev/vulnerability/GHSA-2473-9hgq-j7xw"}],"summary":"Cross-Site Scripting in Wagtail"}