Wagtail vulnerabilities
30 CVEs and advisories name Wagtail as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-125106Wagtail: Improper restriction handling on Page translation API endpoint
- CVE-2026-125105Wagtail: Identification of documents by SHA1 hash
- CVE-2026-123820Wagtail: Improper restriction handling on descendant collections in Documents and Images API
- CVE-2026-123819Wagtail: Improper permission handling when copying snippets
- CVE-2026-55468Wagtail: Improper restriction handling on Pages admin API
- CVE-2026-54263Wagtail: Reflected XSS in dynamic image URL generator view
- CVE-2026-54262Wagtail: Pages translations can be created without page permissions when using simple_translation
- CVE-2026-54261Wagtail: Improper permission handling in image preview
- CVE-2026-54259Wagtail: Improper restriction handling on Documents and Images chosen endpoints
- CVE-2026-54260Wagtail: Denial of service via unbounded filter specs in the image preview
- CVE-2026-44201Wagtail: Improper restriction handling on Documents and Images API
- CVE-2026-44200Wagtail: Improper permission handling when copying pages
- CVE-2026-44199Wagtail: Improper permission handling when deleting form submissions
- CVE-2026-44198Wagtail: Improper permission handling when viewing page history
- CVE-2026-44197Wagtail: Improper permission handling when comparing revisions
- CVE-2026-28222Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes
- CVE-2026-28223Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface
- CVE-2026-25517Wagtail has improper permission handling on admin preview endpoints
- CVE-2024-39317Wagtail regular expression denial-of-service via search query parsing
- CVE-2024-35228Improper Handling of Insufficient Permissions in Wagtail
- CVE-2024-32882Permission check bypass when editing a model with per-field restrictions in wagtail
- CVE-2023-45809Disclosure of user names via admin bulk action views in wagtail
- CVE-2023-28837Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files
- CVE-2023-28836Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
- CVE-2022-21683Comment reply notifications sent to incorrect users in wagtail
- CVE-2021-32681Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks
- CVE-2021-29434Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
- CVE-2020-15118Cross-Site Scripting in Wagtail
- CVE-2020-11037Potential Observable Timing Discrepancy in Wagtail
- CVE-2020-11001Possible XSS attack in Wagtail