UpHeron
All vulnerabilities

Servers and applications

CVE-2023-28836

Stored XSS attack via ModelAdmin views

Severity
Medium 5.4
Published
3 Apr 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.1.4, 4.2.2
Also known as
GHSA-5286-f2rf-35c2
Sources
NVD, Project advisories (GitHub)

Description

Wagtail is an open source content management system built on Django. Starting in version 1.5 and prior to versions 4.1.4 and 4.2.2, a stored cross-site scripting (XSS) vulnerability exists on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft pages and documents that, when viewed by a user with higher…

Affected software

SoftwareAffected versions
WagtailServers and applications · cpe:a:torchbox:wagtail
  • From 1.5 before 4.1.4
  • From 4.2 before 4.2.2
WagtailServers and applications · github:wagtail/wagtail
  • Version 4.2
  • Version 4.2.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-28836
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-28836
  • GitHub Advisory Database https://github.com/advisories/GHSA-5286-f2rf-35c2
  • github.com https://github.com/wagtail/wagtail/security/advisories/GHSA-5286-f2rf-35c2