CVE-2026-28222

MEDIUM

中文标题:

（暂无数据）

英文标题:

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6,

CVSS分数: 6.1

发布时间: 2026-03-05 20:16:15

漏洞类型: （暂无数据）

状态: PUBLISHED

数据质量分数: 0.40

数据版本: v2

漏洞描述

中文描述:

（暂无数据）

英文描述:

Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1.

CWE类型:

CWE-79

受影响产品

厂商	产品	版本	版本范围	平台	CPE
torchbox	wagtail	*	-	-	`cpe:2.3:a:torchbox:wagtail::::::::`
torchbox	wagtail	7.3	-	-	`cpe:2.3:a:torchbox:wagtail:7.3:-::::::`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）