# Wagtail vulnerabilities

Source: https://junglewise.ai/threats/vendors/wagtail  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/wagtail.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 22 vulnerabilities in Wagtail: 3 in the last 7 days and 8 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125106, was published on 9 November 2026. Nothing was published in the last eight weeks. 1 technology has a page of its own.

## Counts

- Last 7 days: 3
- Last 30 days: 3
- Last 90 days: 8
- All time: 22 (0 critical, 0 exploited in the wild)

## About Wagtail

Wagtail is an open-source content management system built on the Django web framework.

## Latest Wagtail vulnerabilities

- [CVE-2026-125106: Wagtail permission bypass in copy page for translation](https://junglewise.ai/threats/cve-2026-125106-wagtail-is-an-open-source-content-management-system-built-on) (medium, CVSS 6.5, published 9 Nov 2026)
- [CVE-2026-123820: Wagtail Documents and Images API access control bypass](https://junglewise.ai/threats/cve-2026-123820-wagtail-is-an-open-source-content-management-system-built-on) (medium, CVSS 5.3, published 9 Nov 2026)
- [CVE-2026-123819: Wagtail snippet copy permission bypass](https://junglewise.ai/threats/cve-2026-123819-wagtail-is-an-open-source-content-management-system-built-on) (medium, CVSS 6.5, published 9 Nov 2026)
- [CVE-2026-55468: Wagtail Pages admin API improper access control](https://junglewise.ai/threats/cve-2026-55468-wagtail-pages-admin-api-improper-access-control) (medium, CVSS 4.3, published 24 Aug 2026)
- [Wagtail improper permission restriction on page translation API](https://junglewise.ai/threats/wagtail-improper-permission-restriction-on-page-translation-api-871f4804) (medium, CVSS 6.5, published 20 Aug 2026)
- [Wagtail improper permission handling when copying snippets](https://junglewise.ai/threats/wagtail-improper-permission-handling-when-copying-snippets-7cffb199) (medium, CVSS 6.5, published 20 Aug 2026)
- [Wagtail improper restriction handling in Documents and Images API](https://junglewise.ai/threats/wagtail-improper-restriction-handling-in-documents-and-images-api-0df25de5) (medium, CVSS 5.3, published 20 Aug 2026)
- [Wagtail document SHA1 hash enumeration via HTTP headers](https://junglewise.ai/threats/wagtail-document-sha1-hash-enumeration-via-http-headers-c56639c4) (low, CVSS 3.7, published 20 Aug 2026)
- [CVE-2026-54263: Wagtail reflected XSS in dynamic image URL generator](https://junglewise.ai/threats/cve-2026-54263-wagtail-reflected-xss-in-dynamic-image-url-generator) (high, CVSS 7.3, published 1 Jul 2026)
- [CVE-2026-54262: Wagtail improper permission handling in simple_translation](https://junglewise.ai/threats/cve-2026-54262-wagtail-improper-permission-handling-in-simple-translation) (medium, CVSS 4.3, published 1 Jul 2026)
- [CVE-2026-54261: Wagtail improper permission handling in image preview](https://junglewise.ai/threats/cve-2026-54261-wagtail-improper-permission-handling-in-image-preview) (medium, CVSS 6.5, published 1 Jul 2026)
- [CVE-2026-54260: Wagtail denial of service via unbounded filter specs in image preview](https://junglewise.ai/threats/cve-2026-54260-wagtail-denial-of-service-via-unbounded-filter-specs-in-image) (medium, CVSS 4.3, published 1 Jul 2026)
- [CVE-2026-54259: Wagtail improper permissions in Documents and Images chooser](https://junglewise.ai/threats/cve-2026-54259-wagtail-improper-permissions-in-documents-and-images-chooser) (medium, CVSS 4.3, published 1 Jul 2026)
- [CVE-2026-44201: Wagtail information disclosure in Documents and Images API](https://junglewise.ai/threats/cve-2026-44201-wagtail-information-disclosure-in-documents-and-images-api) (medium, CVSS 5.3, published 11 May 2026)
- [CVE-2026-44200: Wagtail improper permission handling in page copying](https://junglewise.ai/threats/cve-2026-44200-wagtail-improper-permission-handling-in-page-copying) (medium, CVSS 6.5, published 11 May 2026)
- [CVE-2026-44199: Wagtail improper permission handling in form submission deletion](https://junglewise.ai/threats/cve-2026-44199-wagtail-improper-permission-handling-in-form-submission-deletion) (medium, CVSS 6.5, published 11 May 2026)
- [CVE-2026-44198: Wagtail improper permission handling in page history report](https://junglewise.ai/threats/cve-2026-44198-wagtail-improper-permission-handling-in-page-history-report) (medium, CVSS 4.3, published 11 May 2026)
- [CVE-2026-44197: Wagtail improper permission handling in revision compare view](https://junglewise.ai/threats/cve-2026-44197-wagtail-improper-permission-handling-in-revision-compare-view) (medium, CVSS 6.5, published 11 May 2026)
- [CVE-2026-28222: Wagtail stored XSS in TableBlock class attributes](https://junglewise.ai/threats/cve-2026-28222-wagtail-stored-xss-in-tableblock-class-attributes) (medium, CVSS 6.1, published 3 Mar 2026)
- [CVE-2024-39317: Wagtail ReDoS in parse_query_string](https://junglewise.ai/threats/cve-2024-39317-wagtail-redos-in-parse-query-string) (medium, CVSS 6.5, published 11 Jul 2024)
- [CVE-2021-32681: Wagtail XSS in StreamField include_block tag](https://junglewise.ai/threats/cve-2021-32681-wagtail-xss-in-streamfield-include-block-tag) (medium, CVSS 5.4, published 17 Jun 2021)
- [CVE-2020-15118: Wagtail cross-site scripting in form field help text](https://junglewise.ai/threats/cve-2020-15118-wagtail-cross-site-scripting-in-form-field-help-text) (low, CVSS 3.1, published 20 Jul 2020)

## Most severe Wagtail vulnerabilities

- [CVE-2026-54263: Wagtail reflected XSS in dynamic image URL generator](https://junglewise.ai/threats/cve-2026-54263-wagtail-reflected-xss-in-dynamic-image-url-generator) (high, CVSS 7.3, published 1 Jul 2026)
- [CVE-2024-39317: Wagtail ReDoS in parse_query_string](https://junglewise.ai/threats/cve-2024-39317-wagtail-redos-in-parse-query-string) (medium, CVSS 6.5, published 11 Jul 2024)
- [CVE-2026-44197: Wagtail improper permission handling in revision compare view](https://junglewise.ai/threats/cve-2026-44197-wagtail-improper-permission-handling-in-revision-compare-view) (medium, CVSS 6.5, published 11 May 2026)
- [CVE-2026-54261: Wagtail improper permission handling in image preview](https://junglewise.ai/threats/cve-2026-54261-wagtail-improper-permission-handling-in-image-preview) (medium, CVSS 6.5, published 1 Jul 2026)
- [CVE-2026-44200: Wagtail improper permission handling in page copying](https://junglewise.ai/threats/cve-2026-44200-wagtail-improper-permission-handling-in-page-copying) (medium, CVSS 6.5, published 11 May 2026)
- [CVE-2026-125106: Wagtail permission bypass in copy page for translation](https://junglewise.ai/threats/cve-2026-125106-wagtail-is-an-open-source-content-management-system-built-on) (medium, CVSS 6.5, published 9 Nov 2026)
- [CVE-2026-123819: Wagtail snippet copy permission bypass](https://junglewise.ai/threats/cve-2026-123819-wagtail-is-an-open-source-content-management-system-built-on) (medium, CVSS 6.5, published 9 Nov 2026)
- [CVE-2026-44199: Wagtail improper permission handling in form submission deletion](https://junglewise.ai/threats/cve-2026-44199-wagtail-improper-permission-handling-in-form-submission-deletion) (medium, CVSS 6.5, published 11 May 2026)
- [Wagtail improper permission restriction on page translation API](https://junglewise.ai/threats/wagtail-improper-permission-restriction-on-page-translation-api-871f4804) (medium, CVSS 6.5, published 20 Aug 2026)
- [Wagtail improper permission handling when copying snippets](https://junglewise.ai/threats/wagtail-improper-permission-handling-when-copying-snippets-7cffb199) (medium, CVSS 6.5, published 20 Aug 2026)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 4 | 0 | 0 |
| 24 Aug 2026 | 1 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 3 | 0 | 0 |

## Wagtail technologies

- [Wagtail](https://junglewise.ai/threats/technologies/wagtail): 23 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Wagtail vulnerabilities", https://junglewise.ai/threats/vendors/wagtail, 13 November 2026.