PT-2026-22988 · Wagtail · Wagtail

Gcxwlp · Published 2026-03-03 · Updated 2026-03-10 · CVE-2026-28223

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 6.3.8 Wagtail versions prior to 7.0.6 Wagtail versions prior to 7.2.3 Wagtail versions prior to 7.3.1

Description A stored cross-site scripting (XSS) issue exists within the wagtail.contrib.simple translation module. A user with Wagtail admin access can create a page with a specially crafted title. When another user performs the "Translate" action, this can cause arbitrary JavaScript code to execute, potentially allowing actions to be performed using the other user's credentials. The issue is not exploitable by ordinary site visitors without admin access.

Recommendations Update to Wagtail version 6.3.8 or later. Update to Wagtail version 7.0.6 or later. Update to Wagtail version 7.2.3 or later. Update to Wagtail version 7.3.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28223

GHSA-P4V8-RW59-93CQ

Affected Products

Wagtail

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28223.json · Exploit
• https://github.com/wagtail/wagtail/commit/1c6f2effed68f4ccad6fbd07987e03641505f863 · Patch
• https://github.com/wagtail/wagtail/commit/d8c5900982df8ed5938ad993aa9ff69cda50f80c · Patch
• https://github.com/wagtail/wagtail/commit/ee39d39deeb7f250fe886417b24802d7e05b1143 · Patch
• https://github.com/wagtail/wagtail/security/advisories/GHSA-p4v8-rw59-93cq · Vendor Advisory
• https://github.com/wagtail/wagtail/commit/ba70244d376a7b1bd180ded03e827917ff410c19 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28223 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28223 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p4v8-rw59-93cq · Vendor Advisory
• https://github.com/wagtail/wagtail · Note
• https://github.com/wagtail/wagtail/releases/tag/v6.3.8 · Note
• https://github.com/wagtail/wagtail/releases/tag/v7.3.1 · Note
• https://github.com/wagtail/wagtail/releases/tag/v7.2.3 · Note
• https://github.com/wagtail/wagtail/releases/tag/v7.0.6 · Note
• https://twitter.com/VulmonFeeds/status/2029735675105317184 · Twitter Post