Cross-site scripting in wagtail - #VU156666
Published: October 21, 2026
Vulnerability identifier: #VU156666
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in a victim's browser through stored cross-site scripting, potentially disclosing sensitive information or modifying content accessible to the victim.
The vulnerability exists due to improper sanitization in Wagtail's rich text handling when processing content submitted through the v3 write API or third-party editors using the legacy "Editor HTML" conversion logic. A remote user can submit specially crafted rich text with edit permission over pages or snippets to store malicious HTML and execute scripts when a victim views the affected content.
Affected software
wagtail
Remediation
Install security update from vendor's website.
wagtail - addressed in versions 7.0.10, 7.4.4, 8.0.1