6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28223

CVE-2026-28223: Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28223

CVE-2026-28223:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wagtail	pip	< 6.3.8	6.3.8
wagtail	pip	>= 6.4rc1, < 7.0.6	7.0.6
wagtail	pip	>= 7.1rc1, < 7.2.3	7.2.3
wagtail	pip	>= 7.3rc1, < 7.3.1	7.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-site Scripting (XSS) issue within the wagtail.contrib.simple_translation module of Wagtail. The root cause is the improper handling of user-supplied input, specifically page and snippet titles, when generating confirmation messages in the admin interface.

The analysis of the provided patches reveals that the vulnerability was fixed by making two key changes:

In wagtail/contrib/simple_translation/views.py, the code was changed to use wagtail.admin.messages instead of django.contrib.messages. The wagtail.admin.messages framework is designed to handle HTML escaping by default, which is crucial for preventing XSS.
In the global admin template wagtail/admin/templates/wagtailadmin/base.html, the |safe filter was removed from the rendering of messages ({{ message|safe }} became {{ message }}). This ensures that even if a message contains HTML, it will be treated as plain text and escaped by the template engine, preventing it from being executed by the browser.

The vulnerable functions are the post methods of SubmitPageTranslationView and SubmitSnippetTranslationView. These methods are the entry points that are triggered when a user submits a translation. They are responsible for creating the success messages that contained the unescaped, user-controlled titles, leading to the XSS vulnerability. The new tests added in wagtail/contrib/simple_translation/tests/test_views.py explicitly demonstrate how a malicious title with an <img onerror...> payload would have been rendered, confirming that these views were the source of the vulnerability.

Vulnerable functions

SubmitPageTranslationView.post

wagtail/contrib/simple_translation/views.py

The `post` method of the `SubmitPageTranslationView` class is responsible for handling the form submission when translating a page. It generates a success message that includes the page's title. Prior to the patch, the title was not being escaped, and it was rendered directly into the admin interface. This allowed a user with admin access to craft a malicious page title containing arbitrary HTML and JavaScript, which would then be executed in the browser of another user who translates that page. The fix involves switching to a message system that escapes content by default and removing the `|safe` filter from the template.

SubmitSnippetTranslationView.post

wagtail/contrib/simple_translation/views.py

The `post` method of the `SubmitSnippetTranslationView` class handles the translation of snippets. It creates a success message that includes the snippet's title (or a representation of it). This title was not escaped before being rendered in the confirmation message, creating a stored Cross-site Scripting (XSS) vulnerability. An attacker with admin privileges could create a snippet with a malicious title, and when another user translates it, the malicious code would execute in their browser. The patch mitigates this by ensuring all messages are HTML-escaped before rendering.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.