Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🟠 Wagtail CMS, Stored Cross-site Scripting (XSS), #CVE-2026-28222 (Medium) https://dailycve.com/wagtail-cms-stored-cross-site-scripting-xss-cve-2026-28222-medium/
Post summary
The post announces a new medium‑severity Stored XSS vulnerability in Wagtail CMS (CVE‑2026‑28222), without providing PoC, patches, or exploitation details.
CVE-2026-28222 Stored XSS in Wagtail CMS TableBlock StreamField via Malicious Class Attributes https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28222
Post summary
The message discloses CVE-2026-28222, detailing a stored XSS flaw in Wagtail CMS’s TableBlock StreamField that leverages malicious class attributes. No proof of concept, exploit, patch, or active exploitation report is included.
CVE-2026-28222 Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerabili… https://www.cve.org/CVERecord?id=CVE-2026-28222
Post summary
The text reports a stored XSS vulnerability in earlier versions of Wagtail, providing affected release numbers and linking to the CVE record.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | torchbox | wagtail | - | - | - |
| App | torchbox | wagtail | 7.3 | - | - |
| App | torchbox | wagtail | 7.3 | - | - |