{"action":"Upgrade wagtail to 4.1.4 or later.","affected":[{"fixed":"4.1.4","introduced":"1.5"},{"fixed":"4.2.2","introduced":"4.2"}],"component":"wagtail","cve_ids":["CVE-2023-28836"],"ecosystem":"PyPI","epss":0.00772,"exploited":false,"fixed_versions":["4.1.4","4.2.2"],"ghsa_id":"GHSA-5286-f2rf-35c2","id":"tcs_01M5KEZJ7RZ7FN06A4PBW54W3J","modified_at":"2026-09-10T03:49:53.494353056Z","published_at":"2023-04-03T17:25:27Z","references":["https://osv.dev/vulnerability/GHSA-5286-f2rf-35c2","https://github.com/wagtail/wagtail/security/advisories/GHSA-5286-f2rf-35c2","https://nvd.nist.gov/vuln/detail/CVE-2023-28836","https://github.com/wagtail/wagtail/commit/5be2b1ed55fd7259dfdf2c82e7701dba407b8b62","https://github.com/wagtail/wagtail/commit/bc84bf9815610cfbf8db3b6050c7ddcbaa4b9713","https://github.com/wagtail/wagtail/commit/eefc3381d37b476791610e5d30594fae443f33af","https://github.com/wagtail/wagtail/commit/ff806ab173a504395fdfb3139eb0a29444ab4b91","https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#customising-chooseparentview","https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview","https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2023-55.yaml","https://github.com/wagtail/wagtail","https://github.com/wagtail/wagtail/releases/tag/v4.1.4","https://github.com/wagtail/wagtail/releases/tag/v4.2.2"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-5286-f2rf-35c2","url":"https://osv.dev/vulnerability/GHSA-5286-f2rf-35c2"}],"summary":"Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views"}