Medium
CVE-2026-44201
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access t…
Tag: Wagtail
All CVEs associated with "Wagtail". Page 1/1 • 24 CVEs.
About “Wagtail”
A curated feed of “Wagtail”-related CVEs appears below. We currently track 24 CVEs for this tag (all time). In the last 365 days, 8 were published. Average CVSS is 5.6 (all time; 5.5 over 365d), and 8% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-280 - Improper Handling of Insufficient Permissions or Privileges, CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-862 - Missing Authorization.
In our taxonomy this topic maps to a LOW impact class. CMS and plugins expand attack surface. Patch core, themes, and plugins, remove abandoned extensions, restrict admin access, enable WAF, and keep backups. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.
Support & lifecycle: wagtail
This table shows recent release cycles and their projected end-of-life. Data source: endoflife.date.
| Cycle | Release | Latest | Premier Support | EOL | LTS |
|---|---|---|---|---|---|
| 7.4 | 7.4.1 | LTS | |||
| 7.3 | 7.3.2 | Soon | |||
| 7.2 | 7.2.3 | Expired | |||
| 7.1 | 7.1.3 | Expired | |||
| 7.0 | 7.0.7 | Soon | LTS | ||
| 6.4 | 6.4.2 | Expired | |||
| 6.3 | 6.3.8 | Expired | LTS | ||
| 6.2 | 6.2.4 | Expired | |||
| 6.1 | 6.1.3 | Expired | |||
| 6.0 | 6.0.6 | Expired | |||
| 5.2 | 5.2.8 | Expired | LTS | ||
| 5.1 | 5.1.3 | Expired | |||
| 5.0 | 5.0.5 | Expired | |||
| 4.2 | 4.2.4 | Expired | |||
| 4.1 | 4.1.9 | Expired | LTS | ||
| 4.0 | 4.0.4 | Expired | |||
| 3.0 | 3.0.3 | Expired | |||
| 2.16 | 2.16.3 | Expired | |||
| 2.15 | 2.15.6 | Expired | LTS | ||
| 2.14 | 2.14.2 | Expired | |||
| 2.13 | 2.13.5 | Expired | |||
| 2.12 | 2.12.6 | Expired | |||
| 2.11 | 2.11.9 | Expired | LTS | ||
| 2.10 | 2.10.2 | Expired | |||
| 2.9 | 2.9.3 | Expired | |||
| 2.8 | 2.8.2 | Expired | |||
| 2.7 | 2.7.4 | Expired | LTS | ||
| 2.6 | 2.6.3 | Expired | |||
| 2.5 | 2.5.2 | Expired | |||
| 2.4 | 2.4 | Expired | |||
| 2.3 | 2.3 | Expired | LTS | ||
| 1.13 | 1.13.4 | Expired | LTS | ||
| 1.12 | 1.12.6 | Expired | LTS | ||
| 1.8 | 1.8.2 | Expired | LTS | ||
| 1.4 | 1.4.6 | Expired | LTS | ||
| 0.8 | 0.8.10 | Expired | LTS |
Maintained Soon (≤ 180 days) Expired
Subscribe lifecycle: RSS · RSS (expired) · ICS
Subscribe CVEs: RSS for “Wagtail” · RSS (High+Critical only)
CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).
CVSS ≥ 0.0
2026-05-11
Medium
CVE-2026-44200
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of…
Medium
CVE-2026-44199
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't hav…
Medium
CVE-2026-44198
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page,…
Medium
CVE-2026-44197
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revis…
2026-03-05
Medium
CVE-2026-28223
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation message…
Medium
CVE-2026-28222
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock…
2026-02-04
Low
CVE-2026-25517
Wagtail is an open source content management system built on Django. Prior to versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3, due to a missing permission check on the preview endpoints, a user with acc…
2025-05-07
Medium
CVE-2025-45388
Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting (XSS) in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in…
2024-07-11
Medium
CVE-2024-39317
Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to par…
2024-05-30
Medium
CVE-2024-35228
Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.settings` module, a user with access to the Wagtail admin an…
2024-05-02
Low
CVE-2024-32882
Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet…
2023-10-22
Medium
CVE-2021-46897
views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.
2023-10-19
Low
CVE-2023-45809
Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles…
2023-04-03
Medium
CVE-2023-28837
Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both…
Medium
CVE-2023-28836
Wagtail is an open source content management system built on Django. Starting in version 1.5 and prior to versions 4.1.4 and 4.2.2, a stored cross-site scripting (XSS) vulnerability exists on ModelAd…
2022-01-18
Low
CVE-2022-21683
Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have rep…
2021-06-17
Medium
CVE-2021-32681
Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the…
2021-04-19
Medium
CVE-2021-29434
Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensu…
2020-07-20
Medium
CVE-2020-15118
In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard…
2020-04-30
Medium
CVE-2020-11037
In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password…
2020-04-14
Medium
CVE-2020-11001
In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission…
2020-03-13
High
CVE-2020-5240
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so.…
2019-11-29
High
CVE-2019-16766
When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new de…