CVE-2026-28222: Wagtail stored XSS in TableBlock class attributes

CVE-2026-28222 · Severity: medium · CVSS 6.1 · Published 2026-03-03

Wagtail, a popular content management system, is vulnerable to a security flaw where authorized users can inject malicious code into table components. If a high-privileged user views a page containing this malicious code, the attacker could potentially perform actions on their behalf, leading to unauthorized changes or data access. This issue only affects the administrative interface and cannot be exploited by general website visitors.

Technologies: wagtail (PyPI), Wagtail. Vendors: PyPI, Wagtail.

Quick answers

Is CVE-2026-28222 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28222 being exploited in the wild.
How severe is CVE-2026-28222?
Medium severity, with a CVSS score of 6.1, published 3 March 2026.
Which products and versions are affected?
wagtail (PyPI) ECOSYSTEM:introduced=0,fixed=6.3.8, ECOSYSTEM:introduced=0,fixed=6.3.8,introduced=6.4,fixed=7.0.6,introduced=7.1,fixed=7.2.3; Wagtail < 6.3.8, >= 6.4rc1, < 7.0.6, >= 7.1rc1, < 7.2.3, >= 7.3rc1, < 7.3.1.
Is there a fix for CVE-2026-28222?
Yes. wagtail (PyPI): upgrade to 6.3.8, 7.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28222 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-28222?
Check whether you run wagtail (PyPI) or Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • wagtail (PyPI): upgrade to 6.3.8, 7.2.3 or later
    pip install "wagtail>=7.2.3"

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Wagtail's TableBlock class within the StreamField component. The root cause is improper neutralization of the 'class' attribute when rendering table blocks, allowing a user with page-editing permissions to inject malicious JavaScript. Exploitation requires the attacker to have high privileges (access to the Wagtail admin) and for another user to view the crafted page. Successful exploitation can lead to session hijacking or unauthorized actions performed in the context of the victim's browser. Patches are available in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.

Affected products

  • Wagtail Wagtail < 6.3.8, >= 6.4rc1, < 7.0.6, >= 7.1rc1, < 7.2.3, >= 7.3rc1, < 7.3.1

Identifiers

  • CVE-2026-28222
  • GHSA-p5cm-246w-84jm
  • PYSEC-2026-2307

Timeline

  • 2026-03-03: disclosed
  • 2026-03-03: advisory
  • 2026-03-03: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.