Executive brief
Wagtail, a popular content management system, is vulnerable to a security flaw where authorized users can inject malicious code into table components. If a high-privileged user views a page containing this malicious code, the attacker could potentially perform actions on their behalf, leading to unauthorized changes or data access. This issue only affects the administrative interface and cannot be exploited by general website visitors.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Wagtail's TableBlock class within the StreamField component. The root cause is improper neutralization of the 'class' attribute when rendering table blocks, allowing a user with page-editing permissions to inject malicious JavaScript. Exploitation requires the attacker to have high privileges (access to the Wagtail admin) and for another user to view the crafted page. Successful exploitation can lead to session hijacking or unauthorized actions performed in the context of the victim's browser. Patches are available in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.
Affected products
- Wagtail Wagtail < 6.3.8, >= 6.4rc1, < 7.0.6, >= 7.1rc1, < 7.2.3, >= 7.3rc1, < 7.3.1
Timeline
- 2026-03-03: disclosed
- 2026-03-03: advisory
- 2026-03-03: patched