VulnSocial

CVE-2026-28223Disclosure(torchbox / wagtail)

LOWCVSS 6.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch torchbox wagtail systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.

torchbox CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • wagtail

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 2d ago at 1 mentions (2026-03-05); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
torchbox
Products
wagtail

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-03-05: 1Mentions · 2026-03-06: 1Mentions · 2026-03-10: 1Patch / Workaround · 2026-03-06: 1Technical Details · 2026-03-05: 1Technical Details · 2026-03-06: 1Technical Details · 2026-03-10: 103-0503-0603-10
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Full discourse3 posts
  • DailyCVE@dailycve
    Disclosure

    🟠 Wagtail, Stored XSS, #CVE-2026-28223 (Medium) https://dailycve.com/wagtail-stored-xss-cve-2026-28223-medium/

    Post summary

    An announcement of a stored XSS vulnerability in Wagtail (CVE-2026-28223) with a medium severity score; no PoC, exploit, patch, or active exploitation details are provided.

    0000040
    167 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-28223 Stored XSS Vulnerability in Wagtail CMS Translation Module Before 7.3.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28223

    Post summary

    CVE-2026-28223 is a stored XSS vulnerability in the Wagtail CMS Translation Module affecting versions before 7.3.1; upgrading to 7.3.1 resolves the issue.

    0000056
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-28223 Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerabili… https://www.cve.org/CVERecord?id=CVE-2026-28223

    Post summary

    The post announces CVE-2026-28223, a stored XSS flaw in Wagtail before certain releases, but provides no PoC, exploitation details, or patch information.

    0000076
    56.6K followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Apptorchboxwagtail---
Apptorchboxwagtail7.3--
Apptorchboxwagtail7.3--

Explore more

Back to dashboardtorchbox CVEswagtail vulnerabilities