UpHeron
All vulnerabilities

Servers and applications

CVE-2021-32681

Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks

Severity
Medium 5.4
Published
17 Jun 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.11.8
Also known as
GHSA-xfrw-hxr5-ghqf
Sources
NVD, Project advisories (GitHub)

Description

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the `{% include_block %}` template tag is used to output the value of a plain-text StreamField block (`CharBlock`, `TextBlock` or a similar user-defined block derived from `FieldBlock`), and that block…

Affected software

SoftwareAffected versions
WagtailServers and applications · cpe:a:torchbox:wagtail
  • Every version before 2.11.8
  • From 2.12 up to 2.12.4
  • From 2.13 up to 2.13.1
WagtailServers and applications · github:wagtail/wagtail
  • From 2.13 before 2.11.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-32681
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-32681
  • GitHub Advisory Database https://github.com/advisories/GHSA-xfrw-hxr5-ghqf
  • github.com https://github.com/wagtail/wagtail/security/advisories/GHSA-xfrw-hxr5-ghqf