{"action":"Upgrade wagtail to 4.1.4 or later.","affected":[{"fixed":"4.1.4","introduced":"1.5"},{"fixed":"4.2.2","introduced":"4.2"}],"component":"wagtail","cve_ids":["CVE-2023-28836"],"ecosystem":"PyPI","epss":0.00778,"exploited":false,"fixed_versions":["4.1.4","4.2.2"],"ghsa_id":"GHSA-5286-f2rf-35c2","id":"tcs_01M5KGKM4HKBNTAAC9DRP25XF4","modified_at":"2026-06-08T11:15:06.450712294Z","published_at":"2023-04-03T17:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-55","https://github.com/wagtail/wagtail/releases/tag/v4.2.2","https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#customising-chooseparentview","https://github.com/wagtail/wagtail/security/advisories/GHSA-5286-f2rf-35c2","https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview","https://github.com/wagtail/wagtail/commit/eefc3381d37b476791610e5d30594fae443f33af","https://github.com/wagtail/wagtail/commit/bc84bf9815610cfbf8db3b6050c7ddcbaa4b9713","https://github.com/wagtail/wagtail/commit/5be2b1ed55fd7259dfdf2c82e7701dba407b8b62","https://github.com/wagtail/wagtail/commit/ff806ab173a504395fdfb3139eb0a29444ab4b91"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-55","url":"https://osv.dev/vulnerability/PYSEC-2023-55"}],"summary":"Wagtail is an open source content management system built on Django. Starting in version 1.5 and prior to versions 4.1.4 and 4.2.2, a stored cross-site scripting (XSS) vulnerability exists on ModelAdm"}