fix(deps): update dependency wagtail to v7 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
wagtail (changelog)	==6.4.2 → ==7.0.9

---

Wagtail has improper permission handling on admin preview endpoints

CVE-2026-25517 / GHSA-4qvv-g3vr-m348

More information

Details

Impact

Due to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Many thanks to @​thxtech for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Send an email to security@wagtail.org (view our security policy for more information).

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-4qvv-g3vr-m348
• https://github.com/wagtail/wagtail/commit/01fd3477365a193e6a8270311defb76e890d2719
• https://github.com/wagtail/wagtail/commit/5f09b6da61e779b0e8499bdbba52bf2f7bd3241f
• https://github.com/wagtail/wagtail/commit/73f070dbefbd3b39ea6649ce36bd2d2a6eef2190
• https://github.com/wagtail/wagtail/commit/7dfe8de5f8b3f112c73c87b6729197db16454915
• https://github.com/wagtail/wagtail/commit/dd824023a031f1b82a6b6f83a97a5c73391b7c03
• https://github.com/wagtail/wagtail/releases/tag/v6.3.6
• https://github.com/wagtail/wagtail/releases/tag/v7.0.4
• https://github.com/wagtail/wagtail/releases/tag/v7.1.3
• https://github.com/wagtail/wagtail/releases/tag/v7.2.2
• https://github.com/wagtail/wagtail/releases/tag/v7.3
• https://nvd.nist.gov/vuln/detail/CVE-2026-25517
• https://github.com/advisories/GHSA-4qvv-g3vr-m348

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

CVE-2026-28222 / GHSA-p5cm-246w-84jm

More information

Details

Impact

A stored Cross-site Scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock.

Patches

Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.

Workarounds

Site owners who are unable to upgrade to the new versions can remediate the vulnerability by setting a template attribute on all TableBlock definitions, referencing a template that does not output class attributes. For example:

<!-- For use with TableBlock(template="path/to/table_block.html") -->
<table>
    {% if table_caption %}
        <caption></caption>
    {% endif %}
    {% if table_header %}
        <thead>
            <tr>
                {% for cell in table_header %}
                    <th scope="col"></th>
                {% endfor %}
            </tr>
        </thead>
    {% endif %}
    <tbody>
        {% for row in data %}
            <tr>
                {% for cell in row %}
                    {% if first_col_is_header and forloop.first %}
                        <th scope="row"></th>
                    {% else %}
                        <td></td>
                    {% endif %}
                {% endfor %}
            </tr>
        {% endfor %}
    </tbody>
</table>

Acknowledgements

Many thanks to Guan Chenxian (@​GCXWLP) for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email Wagtail at security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm
• https://github.com/wagtail/wagtail/commit/0375094bb57ce6e527005c2bb2e871dd20bca04d
• https://github.com/wagtail/wagtail/commit/4620423cb22c5253391a0f04178089c1162f6e2e
• https://github.com/wagtail/wagtail/commit/575c0d7c18c7716ed73f7a3c2720ad75956f0a85
• https://github.com/wagtail/wagtail/commit/605a5569686565e035313222e1bc2f9802fbc55b
• https://github.com/wagtail/wagtail/releases/tag/v6.3.8
• https://github.com/wagtail/wagtail/releases/tag/v7.0.6
• https://github.com/wagtail/wagtail/releases/tag/v7.2.3
• https://github.com/wagtail/wagtail/releases/tag/v7.3.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-28222
• https://github.com/advisories/GHSA-p5cm-246w-84jm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface

CVE-2026-28223 / GHSA-p4v8-rw59-93cq

More information

Details

Impact

A stored Cross-site Scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.

Workarounds

None

Acknowledgements

Many thanks to Guan Chenxian (@​GCXWLP) for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email Wagtail at security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-p4v8-rw59-93cq
• https://github.com/wagtail/wagtail/commit/1c6f2effed68f4ccad6fbd07987e03641505f863
• https://github.com/wagtail/wagtail/commit/ba70244d376a7b1bd180ded03e827917ff410c19
• https://github.com/wagtail/wagtail/commit/d8c5900982df8ed5938ad993aa9ff69cda50f80c
• https://github.com/wagtail/wagtail/commit/ee39d39deeb7f250fe886417b24802d7e05b1143
• https://github.com/wagtail/wagtail/releases/tag/v6.3.8
• https://github.com/wagtail/wagtail/releases/tag/v7.0.6
• https://github.com/wagtail/wagtail/releases/tag/v7.2.3
• https://github.com/wagtail/wagtail/releases/tag/v7.3.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-28223
• https://github.com/advisories/GHSA-p4v8-rw59-93cq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail has improper permission handling when comparing revisions

CVE-2026-44197 / GHSA-c6wj-9vcj-75pj

More information

Details

Impact

A CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information.

Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Many thanks to Seoyoung Kang @​seoyoung-kang from AhnLab and an independent security researcher for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Send an email to security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-c6wj-9vcj-75pj
• https://nvd.nist.gov/vuln/detail/CVE-2026-44197
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-146.yaml
• https://github.com/advisories/GHSA-c6wj-9vcj-75pj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail has improper permission handling when viewing page history

CVE-2026-44198 / GHSA-c4mr-889m-vgf6

More information

Details

Impact

A CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information.

Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Wagtail thanks Seoyoung Kang @​seoyoung-kang who is from AhnLab and also an independent security researcher for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Send an email to security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-c4mr-889m-vgf6
• https://nvd.nist.gov/vuln/detail/CVE-2026-44198
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-147.yaml
• https://github.com/advisories/GHSA-c4mr-889m-vgf6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail has improper permission handling when deleting form submissions

CVE-2026-44199 / GHSA-pwm3-7fv4-g6xx

More information

Details

Impact

A CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Wagtail thanks Vishal Shukla @​shukla304 for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Send an email to security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-pwm3-7fv4-g6xx
• https://nvd.nist.gov/vuln/detail/CVE-2026-44199
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-148.yaml
• https://github.com/advisories/GHSA-pwm3-7fv4-g6xx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail has improper restriction handling on Documents and Images API

CVE-2026-44201 / GHSA-p5gm-92h4-6pv6

More information

Details

Impact

The Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections.

Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

Workarounds

Site owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs.

Acknowledgements

Wagtail thanks independent security researcher Sanjok Karki @​thesanjok for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Send an email to security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-p5gm-92h4-6pv6
• https://nvd.nist.gov/vuln/detail/CVE-2026-44201
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-150.yaml
• https://github.com/advisories/GHSA-p5gm-92h4-6pv6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail has improper permission handling when copying pages

CVE-2026-44200 / GHSA-67rv-mg8q-5pf3

More information

Details

Impact

A CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once copied, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page.

Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Wagtail thanks independent security researcher Sanjok Karki @​thesanjok for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Send an email to security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-67rv-mg8q-5pf3
• https://nvd.nist.gov/vuln/detail/CVE-2026-44200
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-149.yaml
• https://github.com/advisories/GHSA-67rv-mg8q-5pf3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail has improper permission handling on admin preview endpoints

CVE-2026-25517 / GHSA-4qvv-g3vr-m348 / PYSEC-2026-2030

More information

Details

Impact

Due to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Many thanks to @​thxtech for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Send an email to security@wagtail.org (view our security policy for more information).

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-4qvv-g3vr-m348
• https://nvd.nist.gov/vuln/detail/CVE-2026-25517
• https://github.com/wagtail/wagtail/commit/01fd3477365a193e6a8270311defb76e890d2719
• https://github.com/wagtail/wagtail/commit/5f09b6da61e779b0e8499bdbba52bf2f7bd3241f
• https://github.com/wagtail/wagtail/commit/73f070dbefbd3b39ea6649ce36bd2d2a6eef2190
• https://github.com/wagtail/wagtail/commit/7dfe8de5f8b3f112c73c87b6729197db16454915
• https://github.com/wagtail/wagtail/commit/dd824023a031f1b82a6b6f83a97a5c73391b7c03
• https://github.com/wagtail/wagtail
• https://github.com/wagtail/wagtail/releases/tag/v6.3.6
• https://github.com/wagtail/wagtail/releases/tag/v7.0.4
• https://github.com/wagtail/wagtail/releases/tag/v7.1.3
• https://github.com/wagtail/wagtail/releases/tag/v7.2.2
• https://github.com/wagtail/wagtail/releases/tag/v7.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail has improper permission handling on admin preview endpoints

CVE-2026-25517 / GHSA-4qvv-g3vr-m348 / PYSEC-2026-2030

More information

Details

Impact

Due to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Many thanks to @​thxtech for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Send an email to security@wagtail.org (view our security policy for more information).

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-4qvv-g3vr-m348
• https://nvd.nist.gov/vuln/detail/CVE-2026-25517
• https://github.com/wagtail/wagtail/commit/01fd3477365a193e6a8270311defb76e890d2719
• https://github.com/wagtail/wagtail/commit/5f09b6da61e779b0e8499bdbba52bf2f7bd3241f
• https://github.com/wagtail/wagtail/commit/73f070dbefbd3b39ea6649ce36bd2d2a6eef2190
• https://github.com/wagtail/wagtail/commit/7dfe8de5f8b3f112c73c87b6729197db16454915
• https://github.com/wagtail/wagtail/commit/dd824023a031f1b82a6b6f83a97a5c73391b7c03
• https://github.com/wagtail/wagtail
• https://github.com/wagtail/wagtail/releases/tag/v6.3.6
• https://github.com/wagtail/wagtail/releases/tag/v7.0.4
• https://github.com/wagtail/wagtail/releases/tag/v7.1.3
• https://github.com/wagtail/wagtail/releases/tag/v7.2.2
• https://github.com/wagtail/wagtail/releases/tag/v7.3
• https://pypi.org/project/wagtail
• https://github.com/advisories/GHSA-4qvv-g3vr-m348

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface

CVE-2026-28223 / GHSA-p4v8-rw59-93cq / PYSEC-2026-2308

More information

Details

Impact

A stored Cross-site Scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.

Workarounds

None

Acknowledgements

Many thanks to Guan Chenxian (@​GCXWLP) for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email Wagtail at security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-p4v8-rw59-93cq
• https://nvd.nist.gov/vuln/detail/CVE-2026-28223
• https://github.com/wagtail/wagtail/commit/1c6f2effed68f4ccad6fbd07987e03641505f863
• https://github.com/wagtail/wagtail/commit/ba70244d376a7b1bd180ded03e827917ff410c19
• https://github.com/wagtail/wagtail/commit/d8c5900982df8ed5938ad993aa9ff69cda50f80c
• https://github.com/wagtail/wagtail/commit/ee39d39deeb7f250fe886417b24802d7e05b1143
• https://github.com/wagtail/wagtail
• https://github.com/wagtail/wagtail/releases/tag/v6.3.8
• https://github.com/wagtail/wagtail/releases/tag/v7.0.6
• https://github.com/wagtail/wagtail/releases/tag/v7.2.3
• https://github.com/wagtail/wagtail/releases/tag/v7.3.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

CVE-2026-28222 / GHSA-p5cm-246w-84jm / PYSEC-2026-2307

More information

Details

Impact

A stored Cross-site Scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock.

Patches

Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.

Workarounds

Site owners who are unable to upgrade to the new versions can remediate the vulnerability by setting a template attribute on all TableBlock definitions, referencing a template that does not output class attributes. For example:

<!-- For use with TableBlock(template="path/to/table_block.html") -->
<table>
    {% if table_caption %}
        <caption></caption>
    {% endif %}
    {% if table_header %}
        <thead>
            <tr>
                {% for cell in table_header %}
                    <th scope="col"></th>
                {% endfor %}
            </tr>
        </thead>
    {% endif %}
    <tbody>
        {% for row in data %}
            <tr>
                {% for cell in row %}
                    {% if first_col_is_header and forloop.first %}
                        <th scope="row"></th>
                    {% else %}
                        <td></td>
                    {% endif %}
                {% endfor %}
            </tr>
        {% endfor %}
    </tbody>
</table>

Acknowledgements

Many thanks to Guan Chenxian (@​GCXWLP) for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Email Wagtail at security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm
• https://nvd.nist.gov/vuln/detail/CVE-2026-28222
• https://github.com/wagtail/wagtail/commit/0375094bb57ce6e527005c2bb2e871dd20bca04d
• https://github.com/wagtail/wagtail/commit/4620423cb22c5253391a0f04178089c1162f6e2e
• https://github.com/wagtail/wagtail/commit/575c0d7c18c7716ed73f7a3c2720ad75956f0a85
• https://github.com/wagtail/wagtail/commit/605a5569686565e035313222e1bc2f9802fbc55b
• https://github.com/wagtail/wagtail
• https://github.com/wagtail/wagtail/releases/tag/v6.3.8
• https://github.com/wagtail/wagtail/releases/tag/v7.0.6
• https://github.com/wagtail/wagtail/releases/tag/v7.2.3
• https://github.com/wagtail/wagtail/releases/tag/v7.3.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

CVE-2026-28222 / GHSA-p5cm-246w-84jm / PYSEC-2026-2307

More information

Details

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

References

• https://github.com/wagtail/wagtail/releases/tag/v6.3.8
• https://github.com/wagtail/wagtail/releases/tag/v7.0.6
• https://github.com/wagtail/wagtail/releases/tag/v7.2.3
• https://github.com/wagtail/wagtail/releases/tag/v7.3.1
• https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm
• https://github.com/wagtail/wagtail/commit/0375094bb57ce6e527005c2bb2e871dd20bca04d
• https://github.com/wagtail/wagtail/commit/4620423cb22c5253391a0f04178089c1162f6e2e
• https://github.com/wagtail/wagtail/commit/575c0d7c18c7716ed73f7a3c2720ad75956f0a85
• https://github.com/wagtail/wagtail/commit/605a5569686565e035313222e1bc2f9802fbc55b

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

CVE-2026-28223 / GHSA-p4v8-rw59-93cq / PYSEC-2026-2308

More information

Details

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

References

• https://github.com/wagtail/wagtail/releases/tag/v6.3.8
• https://github.com/wagtail/wagtail/releases/tag/v7.0.6
• https://github.com/wagtail/wagtail/releases/tag/v7.2.3
• https://github.com/wagtail/wagtail/releases/tag/v7.3.1
• https://github.com/wagtail/wagtail/security/advisories/GHSA-p4v8-rw59-93cq
• https://github.com/wagtail/wagtail/commit/1c6f2effed68f4ccad6fbd07987e03641505f863
• https://github.com/wagtail/wagtail/commit/ba70244d376a7b1bd180ded03e827917ff410c19
• https://github.com/wagtail/wagtail/commit/d8c5900982df8ed5938ad993aa9ff69cda50f80c
• https://github.com/wagtail/wagtail/commit/ee39d39deeb7f250fe886417b24802d7e05b1143

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

Wagtail has improper permission handling when copying pages

CVE-2026-44200 / GHSA-67rv-mg8q-5pf3 / PYSEC-2026-149

More information

Details

Impact

A CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once copied, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page.

Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Wagtail thanks independent security researcher Sanjok Karki @​thesanjok for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Send an email to security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-67rv-mg8q-5pf3
• https://nvd.nist.gov/vuln/detail/CVE-2026-44200
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-149.yaml
• https://github.com/wagtail/wagtail

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail has improper permission handling when viewing page history

CVE-2026-44198 / GHSA-c4mr-889m-vgf6 / PYSEC-2026-147

More information

Details

Impact

A CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information.

Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Wagtail thanks Seoyoung Kang @​seoyoung-kang who is from AhnLab and also an independent security researcher for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Send an email to security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-c4mr-889m-vgf6
• https://nvd.nist.gov/vuln/detail/CVE-2026-44198
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-147.yaml
• https://github.com/wagtail/wagtail

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail has improper permission handling when comparing revisions

CVE-2026-44197 / GHSA-c6wj-9vcj-75pj / PYSEC-2026-146

More information

Details

Impact

A CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information.

Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Many thanks to Seoyoung Kang @​seoyoung-kang from AhnLab and an independent security researcher for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Send an email to security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-c6wj-9vcj-75pj
• https://nvd.nist.gov/vuln/detail/CVE-2026-44197
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-146.yaml
• https://github.com/wagtail/wagtail

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail has improper restriction handling on Documents and Images API

CVE-2026-44201 / GHSA-p5gm-92h4-6pv6 / PYSEC-2026-150

More information

Details

Impact

The Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections.

Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

Workarounds

Site owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs.

Acknowledgements

Wagtail thanks independent security researcher Sanjok Karki @​thesanjok for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Send an email to security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-p5gm-92h4-6pv6
• https://nvd.nist.gov/vuln/detail/CVE-2026-44201
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-150.yaml
• https://github.com/wagtail/wagtail

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Wagtail has improper permission handling when deleting form submissions

CVE-2026-44199 / GHSA-pwm3-7fv4-g6xx / PYSEC-2026-148

More information

Details

Impact

A CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Wagtail thanks Vishal Shukla @​shukla304 for reporting this issue.

For more information

If there are any questions or comments about this advisory:

• Visit Wagtail's support channels
• Send an email to security@wagtail.org (view the security policy for more information).

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-pwm3-7fv4-g6xx
• https://nvd.nist.gov/vuln/detail/CVE-2026-44199
• https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-148.yaml
• https://github.com/wagtail/wagtail

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

CVE-2026-44197 / GHSA-c6wj-9vcj-75pj / PYSEC-2026-146

More information

Details

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-c6wj-9vcj-75pj

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

CVE-2026-44198 / GHSA-c4mr-889m-vgf6 / PYSEC-2026-147

More information

Details

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-c4mr-889m-vgf6

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

CVE-2026-44199 / [GHSA-pwm3-7fv4-g6xx](https://redirect.github.com/advisories/GHSA

✂ Note

PR body was truncated to here.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: uv.lock

Command failed: uv lock --upgrade-package wagtail
Downloading cpython-3.13.15-linux-x86_64-gnu (download) (33.2MiB)
 Downloaded cpython-3.13.15-linux-x86_64-gnu (download)
Using CPython 3.13.15
  × No solution found when resolving dependencies for split (markers:
  │ python_full_version >= '3.14' and python_full_version < '4'):
  ╰─▶ Because there is no version of wagtail==7.0.9 and your project depends
      on wagtail==7.0.9, we can conclude that your project's requirements
      are unsatisfiable.

hint: While the active Python version is 3.13, the resolution failed for other Python versions supported by your project. Consider limiting your project's supported Python versions using `requires-python`.
hint: `wagtail` was filtered by `exclude-newer` to only include packages uploaded before 2026-08-13T22:03:48.455560446Z. The requested version, v7.0.9, was published at 2026-08-20T15:27:21.873Z. Consider using `exclude-newer-package` to override the cutoff for this package.