Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-54263 Reflected XSS in Wagtail Dynamic Image URL Generator Below 7.0.8, 7.3.3, 7.4.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54263
Post summary
CVE‑2026‑54263 is a reflected XSS flaw in Wagtail’s Dynamic Image URL Generator affecting versions below 7.0.8, 7.3.3, and 7.4.2, with no PoC, exploit code, or active exploitation reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | torchbox | wagtail | - | - | - |