Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

wagtail

27 known vulnerabilities (1 high, 23 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
27 · 1 high, 23 medium, 3 low
Weekly downloads
166.5K
Dependents
409
Registry
PyPI

Advisories 27

  • CVE-2026-55468Medium 4.3

    Wagtail: Improper restriction handling on Pages admin API

    Affected: fixed in 7.0.9; from 7.1, fixed in 7.3.4; from 7.4, fixed in 7.4.3; from 8.0rc1, fixed in 8.0rc2; fixed in 7.0.9; from 7.1, fixed in 7.3.4; from 7.4, fixed in 7.4.3; from 8.0rc1, fixed in 8.0rc2.

  • Wagtail: Improper restriction handling on Page translation API endpoint

    Affected: fixed in 7.0.9; from 7.1rc1, fixed in 7.3.4; from 7.4rc1, fixed in 7.4.3; from 8.0rc1, fixed in 8.0rc2.

  • Wagtail: Reflected XSS in dynamic image URL generator view

    Affected: from 7.3, fixed in 7.3.3; from 7.4, fixed in 7.4.2; from 7.3, fixed in 7.3.3; from 7.4, fixed in 7.4.2.

  • CVE-2026-54262Medium 4.3

    Wagtail: Pages translations can be created without page permissions when using simple_translation

    Affected: fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2; fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2.

  • CVE-2026-54261Medium 6.5

    Wagtail: Improper permission handling in image preview

    Affected: fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2; fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2.

  • CVE-2026-54259Medium 4.3

    Wagtail: Improper restriction handling on Documents and Images chosen endpoints

    Affected: fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2; fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2.

  • CVE-2026-54260Medium 4.3

    Wagtail: Denial of service via unbounded filter specs in the image preview

    Affected: fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2; fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2.

  • CVE-2026-44201Medium 5.3

    Wagtail: Improper restriction handling on Documents and Images API

    Affected: fixed in 7.0.7; from 7.1, fixed in 7.3.2; fixed in 7.0.7; from 7.1, fixed in 7.3.2.

  • CVE-2026-44200Medium 6.5

    Wagtail: Improper permission handling when copying pages

    Affected: fixed in 7.0.7; from 7.1, fixed in 7.3.2; fixed in 7.0.7; from 7.1, fixed in 7.3.2.

  • CVE-2026-44199Medium 6.5

    Wagtail: Improper permission handling when deleting form submissions

    Affected: fixed in 7.0.7; from 7.1, fixed in 7.3.2; fixed in 7.0.7; from 7.1, fixed in 7.3.2.

  • CVE-2026-44198Medium 4.3

    Wagtail: Improper permission handling when viewing page history

    Affected: fixed in 7.0.7; from 7.1, fixed in 7.3.2; fixed in 7.0.7; from 7.1, fixed in 7.3.2.

  • CVE-2026-44197Medium 6.5

    Wagtail: Improper permission handling when comparing revisions

    Affected: fixed in 7.0.7; from 7.1, fixed in 7.3.2; fixed in 7.0.7; from 7.1, fixed in 7.3.2.

  • CVE-2026-28222Medium 6.1

    Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes

    Affected: fixed in 6.3.8; from 6.4, fixed in 7.0.6; from 7.1, fixed in 7.2.3; fixed in 6.3.8; from 6.4rc1, fixed in 7.0.6; from 7.1rc1, fixed in 7.2.3; from 7.3rc1, fixed in 7.3.1.

  • CVE-2026-28223Medium 6.1

    Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface

    Affected: fixed in 6.3.8; from 6.4, fixed in 7.0.6; from 7.1, fixed in 7.2.3; fixed in 6.3.8; from 6.4rc1, fixed in 7.0.6; from 7.1rc1, fixed in 7.2.3; from 7.3rc1, fixed in 7.3.1.

  • CVE-2026-25517Medium 5.1

    Wagtail has improper permission handling on admin preview endpoints

    Affected: fixed in 6.3.6; from 6.4rc1, fixed in 7.0.4; from 7.1rc1, fixed in 7.1.3; from 7.2rc1, fixed in 7.2.2; from 7.3rc1, fixed in 7.3; fixed in 6.3.6; from 6.4rc1, fixed in 7.0.4; from 7.1rc1, fixed in 7.1.3; from 7.2rc1, fixed in 7.2.2; from 7.3rc1, fixed in 7.3.

Show all 27 advisoriesShow fewer advisories
  • CVE-2024-39317Medium 6.5

    Wagtail regular expression denial-of-service via search query parsing

    Affected: from 6.0, fixed in 6.0.6; from 6.1, fixed in 6.1.3; from 2.0, fixed in 5.2.6; from 6.0, fixed in 6.0.6; from 6.1, fixed in 6.1.3; from 2.0, fixed in 5.2.6.

  • CVE-2024-35228Medium 5.5

    Improper Handling of Insufficient Permissions in Wagtail

    Affected: from 6.0.0, fixed in 6.0.5; from 6.1.0, fixed in 6.1.2; from 6.0.0, fixed in 6.0.5; from 6.1.0, fixed in 6.1.2.

  • Permission check bypass when editing a model with per-field restrictions in wagtail

    Affected: from 6.0.0, fixed in 6.0.3.

  • Disclosure of user names via admin bulk action views in wagtail

    Affected: fixed in 4.1.9; from 4.2, fixed in 5.0.5; from 5.1, fixed in 5.1.3; fixed in 4.1.9; from 4.2.0, fixed in 5.0.5; from 5.1.0, fixed in 5.1.3.

  • CVE-2023-28837Medium 4.9

    Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

    Affected: from 4.2, fixed in 4.2.2; fixed in 4.1.4; from 4.2, fixed in 4.2.2; fixed in 4.1.4.

  • CVE-2023-28836Medium 6.4

    Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views

    Affected: from 1.5, fixed in 4.1.4; from 4.2, fixed in 4.2.2; from 1.5, fixed in 4.1.4; from 4.2, fixed in 4.2.2.

  • Comment reply notifications sent to incorrect users in wagtail

    Affected: from 2.13, fixed in 2.15.2.

  • CVE-2021-32681Medium 5.4

    Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks

    Affected: fixed in 2.11.8; from 2.12, fixed in 2.12.5; from 2.13, fixed in 2.13.2; fixed in 2.11.8; from 2.12, fixed in 2.12.5; from 2.13, fixed in 2.13.2.

  • CVE-2021-29434Medium 6.1

    Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

    Affected: fixed in 2.11.7; from 2.12, fixed in 2.12.4; from 2.11, fixed in 2.11.7; fixed in 2.11.6; from 2.12, fixed in 2.12.4.

  • CVE-2020-15118Medium 5.7

    Cross-Site Scripting in Wagtail

    Affected: from 2.8rc1, fixed in 2.9.3; fixed in 2.7.4; from 2.7, fixed in 2.7.4; from 2.9, fixed in 2.9.3.

  • CVE-2020-11037Medium 6.1

    Potential Observable Timing Discrepancy in Wagtail

    Affected: from 2.7, fixed in 2.7.3; from 2.8, fixed in 2.8.2; fixed in 2.7.3; from 2.8rc1, fixed in 2.8.2; from 2.9rc1, fixed in 2.9.

  • CVE-2020-11001Medium 5.8

    Possible XSS attack in Wagtail

    Affected: from 1.9, fixed in 2.7.2; from 1.9.0, fixed in 2.7.2; from 2.8.0, fixed in 2.8.1.