https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:12:34 +0000 https://cve.radiocsirt.org/vuln/cve-2026-28223 <p><strong>Affected:</strong> wagtail</p> <p>Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the &#34;Translate&#34; action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user&#39;s credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.</p> <p><strong>Affected:</strong> wagtail</p> <p>Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the &#34;Translate&#34; action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user&#39;s credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.</p> https://cve.radiocsirt.org/vuln/cve-2026-28223 https://cve.radiocsirt.org/vuln/ghsa-p4v8-rw59-93cq <p><strong>Affected:</strong> PyPI: wagtail</p> <p>### Impact A stored Cross-site Scripting (XSS) vulnerability exists on confirmation messages within the `wagtail.contrib.simple_translation` module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the &#34;Translate&#34; action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user&#39;s credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.</p> <p>### Patches Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.</p> <p>### Workarounds None</p> <p>### Acknowledgements</p> <p>Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.</p> <p>### For more information</p> <p>If there are any questions or comments about this advisory:</p> <p>- Visit Wagtail&#39;s [support channels](https://docs.wagtail.io/en/stable/support.html) - Email Wagtail at [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).</p> <p><strong>Affected:</strong> PyPI: wagtail</p> <p>### Impact A stored Cross-site Scripting (XSS) vulnerability exists on confirmation messages within the `wagtail.contrib.simple_translation` module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the &#34;Translate&#34; action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user&#39;s credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.</p> <p>### Patches Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.</p> <p>### Workarounds None</p> <p>### Acknowledgements</p> <p>Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.</p> <p>### For more information</p> <p>If there are any questions or comments about this advisory:</p> <p>- Visit Wagtail&#39;s [support channels](https://docs.wagtail.io/en/stable/support.html) - Email Wagtail at [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).</p> https://cve.radiocsirt.org/vuln/ghsa-p4v8-rw59-93cq