PT-2026-22987 · Wagtail+1 · Wagtail+1

Gcxwlp · Published 2026-03-03 · Updated 2026-03-10 · CVE-2026-28222

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 6.3.8 Wagtail versions prior to 7.0.6 Wagtail versions prior to 7.2.3 Wagtail versions prior to 7.3.1

Description Wagtail, an open source content management system built on Django, contains a stored cross-site scripting (XSS) issue affecting the rendering of TableBlock blocks within a StreamField. A user with the ability to create or edit pages containing TableBlock StreamField blocks can set specially crafted class attributes on the block. This allows for the execution of arbitrary JavaScript code when the page is viewed. If viewed by a user with elevated privileges, this could potentially lead to actions being performed with those credentials. The issue is not exploitable by ordinary site visitors without access to the Wagtail admin interface and only impacts sites utilizing TableBlock.

Recommendations Wagtail versions prior to 6.3.8 should be upgraded to version 6.3.8 or later. Wagtail versions prior to 7.0.6 should be upgraded to version 7.0.6 or later. Wagtail versions prior to 7.2.3 should be upgraded to version 7.2.3 or later. Wagtail versions prior to 7.3.1 should be upgraded to version 7.3.1 or later. As a temporary workaround, site owners unable to upgrade can remediate the issue by setting a template attribute on all TableBlock definitions, referencing a template that does not output class attributes.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28222

GHSA-P5CM-246W-84JM

Affected Products

Django

Wagtail

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28222.json · Exploit
• https://github.com/wagtail/wagtail/commit/605a5569686565e035313222e1bc2f9802fbc55b · Patch
• https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm · Vendor Advisory
• https://github.com/wagtail/wagtail/commit/4620423cb22c5253391a0f04178089c1162f6e2e · Patch
• https://github.com/wagtail/wagtail/commit/0375094bb57ce6e527005c2bb2e871dd20bca04d · Patch
• https://github.com/wagtail/wagtail/commit/575c0d7c18c7716ed73f7a3c2720ad75956f0a85 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28222 · Security Note
• https://osv.dev/vulnerability/GHSA-p5cm-246w-84jm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28222 · Vendor Advisory
• https://github.com/wagtail/wagtail · Note
• https://github.com/wagtail/wagtail/releases/tag/v6.3.8 · Note
• https://github.com/wagtail/wagtail/releases/tag/v7.3.1 · Note
• https://github.com/wagtail/wagtail/releases/tag/v7.2.3 · Note
• https://github.com/wagtail/wagtail/releases/tag/v7.0.6 · Note
• https://twitter.com/CVEnew/status/2029654701583507488 · Twitter Post