# wagtail (PyPI) vulnerabilities

27 known vulnerabilities (1 high, 23 medium, 3 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Weekly downloads: 166.5K
- Dependents: 409
- Registry: https://pypi.org/project/wagtail/

## Advisories (27)

### [CVE-2026-55468](https://cve.now/CVE-2026-55468): Wagtail: Improper restriction handling on Pages admin API

- Severity: Medium 4.3
- Published: Aug 24, 2026
- Affected: fixed in 7.0.9; from 7.1, fixed in 7.3.4; from 7.4, fixed in 7.4.3; from 8.0rc1, fixed in 8.0rc2; fixed in 7.0.9; from 7.1, fixed in 7.3.4; from 7.4, fixed in 7.4.3; from 8.0rc1, fixed in 8.0rc2.

### [GHSA-JM5P-837G-RV8G](https://cve.now/GHSA-JM5P-837G-RV8G): Wagtail: Improper restriction handling on Page translation API endpoint

- Severity: Medium
- Published: Aug 20, 2026
- Affected: fixed in 7.0.9; from 7.1rc1, fixed in 7.3.4; from 7.4rc1, fixed in 7.4.3; from 8.0rc1, fixed in 8.0rc2.

### [CVE-2026-54263](https://cve.now/CVE-2026-54263): Wagtail: Reflected XSS in dynamic image URL generator view

- Severity: High 7.3
- Published: Jul 1, 2026
- Affected: from 7.3, fixed in 7.3.3; from 7.4, fixed in 7.4.2; from 7.3, fixed in 7.3.3; from 7.4, fixed in 7.4.2.

### [CVE-2026-54262](https://cve.now/CVE-2026-54262): Wagtail: Pages translations can be created without page permissions when using simple\_translation

- Severity: Medium 4.3
- Published: Jul 1, 2026
- Affected: fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2; fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2.

### [CVE-2026-54261](https://cve.now/CVE-2026-54261): Wagtail: Improper permission handling in image preview

- Severity: Medium 6.5
- Published: Jul 1, 2026
- Affected: fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2; fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2.

### [CVE-2026-54259](https://cve.now/CVE-2026-54259): Wagtail: Improper restriction handling on Documents and Images chosen endpoints

- Severity: Medium 4.3
- Published: Jul 1, 2026
- Affected: fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2; fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2.

### [CVE-2026-54260](https://cve.now/CVE-2026-54260): Wagtail: Denial of service via unbounded filter specs in the image preview

- Severity: Medium 4.3
- Published: Jul 1, 2026
- Affected: fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2; fixed in 7.0.8; from 7.1, fixed in 7.3.3; from 7.4, fixed in 7.4.2.

### [CVE-2026-44201](https://cve.now/CVE-2026-44201): Wagtail: Improper restriction handling on Documents and Images API

- Severity: Medium 5.3
- Published: May 11, 2026
- Affected: fixed in 7.0.7; from 7.1, fixed in 7.3.2; fixed in 7.0.7; from 7.1, fixed in 7.3.2.

### [CVE-2026-44200](https://cve.now/CVE-2026-44200): Wagtail: Improper permission handling when copying pages

- Severity: Medium 6.5
- Published: May 11, 2026
- Affected: fixed in 7.0.7; from 7.1, fixed in 7.3.2; fixed in 7.0.7; from 7.1, fixed in 7.3.2.

### [CVE-2026-44199](https://cve.now/CVE-2026-44199): Wagtail: Improper permission handling when deleting form submissions

- Severity: Medium 6.5
- Published: May 11, 2026
- Affected: fixed in 7.0.7; from 7.1, fixed in 7.3.2; fixed in 7.0.7; from 7.1, fixed in 7.3.2.

### [CVE-2026-44198](https://cve.now/CVE-2026-44198): Wagtail: Improper permission handling when viewing page history

- Severity: Medium 4.3
- Published: May 11, 2026
- Affected: fixed in 7.0.7; from 7.1, fixed in 7.3.2; fixed in 7.0.7; from 7.1, fixed in 7.3.2.

### [CVE-2026-44197](https://cve.now/CVE-2026-44197): Wagtail: Improper permission handling when comparing revisions

- Severity: Medium 6.5
- Published: May 11, 2026
- Affected: fixed in 7.0.7; from 7.1, fixed in 7.3.2; fixed in 7.0.7; from 7.1, fixed in 7.3.2.

### [CVE-2026-28222](https://cve.now/CVE-2026-28222): Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes

- Severity: Medium 6.1
- Published: Mar 5, 2026
- Affected: fixed in 6.3.8; from 6.4, fixed in 7.0.6; from 7.1, fixed in 7.2.3; fixed in 6.3.8; from 6.4rc1, fixed in 7.0.6; from 7.1rc1, fixed in 7.2.3; from 7.3rc1, fixed in 7.3.1.

### [CVE-2026-28223](https://cve.now/CVE-2026-28223): Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple\_translation admin interface

- Severity: Medium 6.1
- Published: Mar 5, 2026
- Affected: fixed in 6.3.8; from 6.4, fixed in 7.0.6; from 7.1, fixed in 7.2.3; fixed in 6.3.8; from 6.4rc1, fixed in 7.0.6; from 7.1rc1, fixed in 7.2.3; from 7.3rc1, fixed in 7.3.1.

### [CVE-2026-25517](https://cve.now/CVE-2026-25517): Wagtail has improper permission handling on admin preview endpoints

- Severity: Medium 5.1
- Published: Feb 4, 2026
- Affected: fixed in 6.3.6; from 6.4rc1, fixed in 7.0.4; from 7.1rc1, fixed in 7.1.3; from 7.2rc1, fixed in 7.2.2; from 7.3rc1, fixed in 7.3; fixed in 6.3.6; from 6.4rc1, fixed in 7.0.4; from 7.1rc1, fixed in 7.1.3; from 7.2rc1, fixed in 7.2.2; from 7.3rc1, fixed in 7.3.

### [CVE-2024-39317](https://cve.now/CVE-2024-39317): Wagtail regular expression denial-of-service via search query parsing

- Severity: Medium 6.5
- Published: Jul 11, 2024
- Affected: from 6.0, fixed in 6.0.6; from 6.1, fixed in 6.1.3; from 2.0, fixed in 5.2.6; from 6.0, fixed in 6.0.6; from 6.1, fixed in 6.1.3; from 2.0, fixed in 5.2.6.

### [CVE-2024-35228](https://cve.now/CVE-2024-35228): Improper Handling of Insufficient Permissions in Wagtail

- Severity: Medium 5.5
- Published: May 30, 2024
- Affected: from 6.0.0, fixed in 6.0.5; from 6.1.0, fixed in 6.1.2; from 6.0.0, fixed in 6.0.5; from 6.1.0, fixed in 6.1.2.

### [CVE-2024-32882](https://cve.now/CVE-2024-32882): Permission check bypass when editing a model with per-field restrictions in wagtail

- Severity: Low 2.7
- Published: May 2, 2024
- Affected: from 6.0.0, fixed in 6.0.3.

### [CVE-2023-45809](https://cve.now/CVE-2023-45809): Disclosure of user names via admin bulk action views in wagtail

- Severity: Low 2.7
- Published: Oct 19, 2023
- Affected: fixed in 4.1.9; from 4.2, fixed in 5.0.5; from 5.1, fixed in 5.1.3; fixed in 4.1.9; from 4.2.0, fixed in 5.0.5; from 5.1.0, fixed in 5.1.3.

### [CVE-2023-28837](https://cve.now/CVE-2023-28837): Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

- Severity: Medium 4.9
- Published: Apr 3, 2023
- Affected: from 4.2, fixed in 4.2.2; fixed in 4.1.4; from 4.2, fixed in 4.2.2; fixed in 4.1.4.

### [CVE-2023-28836](https://cve.now/CVE-2023-28836): Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views

- Severity: Medium 6.4
- Published: Apr 3, 2023
- Affected: from 1.5, fixed in 4.1.4; from 4.2, fixed in 4.2.2; from 1.5, fixed in 4.1.4; from 4.2, fixed in 4.2.2.

### [CVE-2022-21683](https://cve.now/CVE-2022-21683): Comment reply notifications sent to incorrect users in wagtail

- Severity: Low 3.5
- Published: Jan 18, 2022
- Affected: from 2.13, fixed in 2.15.2.

### [CVE-2021-32681](https://cve.now/CVE-2021-32681): Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks

- Severity: Medium 5.4
- Published: Jun 17, 2021
- Affected: fixed in 2.11.8; from 2.12, fixed in 2.12.5; from 2.13, fixed in 2.13.2; fixed in 2.11.8; from 2.12, fixed in 2.12.5; from 2.13, fixed in 2.13.2.

### [CVE-2021-29434](https://cve.now/CVE-2021-29434): Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

- Severity: Medium 6.1
- Published: Apr 19, 2021
- Affected: fixed in 2.11.7; from 2.12, fixed in 2.12.4; from 2.11, fixed in 2.11.7; fixed in 2.11.6; from 2.12, fixed in 2.12.4.

### [CVE-2020-15118](https://cve.now/CVE-2020-15118): Cross-Site Scripting in Wagtail

- Severity: Medium 5.7
- Published: Jul 20, 2020
- Affected: from 2.8rc1, fixed in 2.9.3; fixed in 2.7.4; from 2.7, fixed in 2.7.4; from 2.9, fixed in 2.9.3.

### [CVE-2020-11037](https://cve.now/CVE-2020-11037): Potential Observable Timing Discrepancy in Wagtail

- Severity: Medium 6.1
- Published: Apr 30, 2020
- Affected: from 2.7, fixed in 2.7.3; from 2.8, fixed in 2.8.2; fixed in 2.7.3; from 2.8rc1, fixed in 2.8.2; from 2.9rc1, fixed in 2.9.

### [CVE-2020-11001](https://cve.now/CVE-2020-11001): Possible XSS attack in Wagtail

- Severity: Medium 5.8
- Published: Apr 14, 2020
- Affected: from 1.9, fixed in 2.7.2; from 1.9.0, fixed in 2.7.2; from 2.8.0, fixed in 2.8.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/wagtail
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.