CVE-2026-28223CWE-79

Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface

Medium · published March 5, 2026

CVSS v3.1
6.1
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00626 · 49.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-05T18:56Z
EPSS history
Timeline
  • 05 MAR 18:56Z
    Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface
    cvelistv5