What’s Vulnerable › Products

wagtail vulnerabilities

25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Check whether your wagtail version is affected

Latest wagtail vulnerabilities

• CVE-2026-55468 — Wagtail: Improper restriction handling on Pages admin API (CVSS 4.3)
• CVE-2026-54263 — Wagtail: Reflected XSS in dynamic image URL generator view (CVSS 7.3)
• CVE-2026-54262 — Wagtail: Pages translations can be created without page permissions when using simple_translation (CVSS 4.3)
• CVE-2026-54261 — Wagtail: Improper permission handling in image preview (CVSS 6.5)
• CVE-2026-54260 — Wagtail: Denial of service via unbounded filter specs in the image preview (CVSS 2.7)
• CVE-2026-54259 — Wagtail: Improper restriction handling on Documents and Images chosen endpoints (CVSS 4.3)
• CVE-2026-44201 — Wagtail: Improper restriction handling on Documents and Images API (CVSS 5.3)
• CVE-2026-44200 — Wagtail: Improper permission handling when copying pages (CVSS 6.5)
• CVE-2026-44199 — Wagtail: Improper permission handling when deleting form submissions (CVSS 6.5)
• CVE-2026-44198 — Wagtail: Improper permission handling when viewing page history (CVSS 4.3)
• CVE-2026-44197 — Wagtail: Improper permission handling when comparing revisions (CVSS 6.5)
• CVE-2026-28223 — Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface (CVSS 6.1)
• CVE-2026-28222 — Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes (CVSS 6.1)
• CVE-2026-25517 — Wagtail has improper permission handling on admin preview endpoints (CVSS 2.7)
• CVE-2024-39317 — Wagtail regular expression denial-of-service via search query parsing (CVSS 4.9)
• CVE-2024-35228 — Improper Handling of Insufficient Permissions in Wagtail (CVSS 5.5)
• CVE-2023-45809 — Disclosure of user names via admin bulk action views in wagtail (CVSS 2.7)
• CVE-2023-28837 — Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files (CVSS 4.9)
• CVE-2023-28836 — Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views (CVSS 5.4)
• CVE-2022-21683 — Comment reply notifications sent to incorrect users in wagtail (CVSS 4.3)
• CVE-2021-32681 — Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks (CVSS 5.4)
• CVE-2021-29434 — Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields (CVSS 4.8)
• CVE-2020-15118 — Cross-Site Scripting in Wagtail (CVSS 5.4)
• CVE-2020-11037 — Potential Observable Timing Discrepancy in Wagtail (CVSS 4.7)
• CVE-2020-11001 — Possible XSS attack in Wagtail (CVSS 6.8)