CVE-2026-28222

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28222", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T15:28:40.650Z", "datePublished": "2026-03-05T18:58:20.719Z", "dateUpdated": "2026-03-06T18:05:28.611Z"}, "containers": {"cna": {"title": "Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm"}, {"name": "https://github.com/wagtail/wagtail/commit/0375094bb57ce6e527005c2bb2e871dd20bca04d", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/commit/0375094bb57ce6e527005c2bb2e871dd20bca04d"}, {"name": "https://github.com/wagtail/wagtail/commit/4620423cb22c5253391a0f04178089c1162f6e2e", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/commit/4620423cb22c5253391a0f04178089c1162f6e2e"}, {"name": "https://github.com/wagtail/wagtail/commit/575c0d7c18c7716ed73f7a3c2720ad75956f0a85", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/commit/575c0d7c18c7716ed73f7a3c2720ad75956f0a85"}, {"name": "https://github.com/wagtail/wagtail/commit/605a5569686565e035313222e1bc2f9802fbc55b", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/commit/605a5569686565e035313222e1bc2f9802fbc55b"}, {"name": "https://github.com/wagtail/wagtail/releases/tag/v6.3.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/releases/tag/v6.3.8"}, {"name": "https://github.com/wagtail/wagtail/releases/tag/v7.0.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/releases/tag/v7.0.6"}, {"name": "https://github.com/wagtail/wagtail/releases/tag/v7.2.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/releases/tag/v7.2.3"}, {"name": "https://github.com/wagtail/wagtail/releases/tag/v7.3.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/wagtail/wagtail/releases/tag/v7.3.1"}], "affected": [{"vendor": "wagtail", "product": "wagtail", "versions": [{"version": "< 6.3.8", "status": "affected"}, {"version": ">= 6.4rc1, < 7.0.6", "status": "affected"}, {"version": ">= 7.1rc1, < 7.2.3", "status": "affected"}, {"version": ">= 7.3rc1, < 7.3.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T18:58:20.719Z"}, "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1."}], "source": {"advisory": "GHSA-p5cm-246w-84jm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T18:05:22.577268Z", "id": "CVE-2026-28222", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:05:28.611Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28222", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-06T18:05:22.577268Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:05:25.331Z"}}], "cna": {"title": "Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes", "source": {"advisory": "GHSA-p5cm-246w-84jm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "wagtail", "product": "wagtail", "versions": [{"status": "affected", "version": "< 6.3.8"}, {"status": "affected", "version": ">= 6.4rc1, < 7.0.6"}, {"status": "affected", "version": ">= 7.1rc1, < 7.2.3"}, {"status": "affected", "version": ">= 7.3rc1, < 7.3.1"}]}], "references": [{"url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm", "name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/wagtail/wagtail/commit/0375094bb57ce6e527005c2bb2e871dd20bca04d", "name": "https://github.com/wagtail/wagtail/commit/0375094bb57ce6e527005c2bb2e871dd20bca04d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wagtail/wagtail/commit/4620423cb22c5253391a0f04178089c1162f6e2e", "name": "https://github.com/wagtail/wagtail/commit/4620423cb22c5253391a0f04178089c1162f6e2e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wagtail/wagtail/commit/575c0d7c18c7716ed73f7a3c2720ad75956f0a85", "name": "https://github.com/wagtail/wagtail/commit/575c0d7c18c7716ed73f7a3c2720ad75956f0a85", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wagtail/wagtail/commit/605a5569686565e035313222e1bc2f9802fbc55b", "name": "https://github.com/wagtail/wagtail/commit/605a5569686565e035313222e1bc2f9802fbc55b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wagtail/wagtail/releases/tag/v6.3.8", "name": "https://github.com/wagtail/wagtail/releases/tag/v6.3.8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wagtail/wagtail/releases/tag/v7.0.6", "name": "https://github.com/wagtail/wagtail/releases/tag/v7.0.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wagtail/wagtail/releases/tag/v7.2.3", "name": "https://github.com/wagtail/wagtail/releases/tag/v7.2.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wagtail/wagtail/releases/tag/v7.3.1", "name": "https://github.com/wagtail/wagtail/releases/tag/v7.3.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T18:58:20.719Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28222", "state": "PUBLISHED", "dateUpdated": "2026-03-06T18:05:28.611Z", "dateReserved": "2026-02-25T15:28:40.650Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-05T18:58:20.719Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "wagtail", "vendor": "wagtail", "versions": [{"status": "affected", "version": "< 6.3.8"}, {"status": "affected", "version": ">= 6.4rc1, < 7.0.6"}, {"status": "affected", "version": ">= 7.1rc1, < 7.2.3"}, {"status": "affected", "version": ">= 7.3rc1, < 7.3.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "matchCriteriaId": "F649E022-3713-4AF4-864F-D19BC4DE9480", "versionEndExcluding": "6.3.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC322B0E-ECBA-42DB-B913-1E284B94E77F", "versionEndExcluding": "7.0.6", "versionStartIncluding": "6.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*", "matchCriteriaId": "5AFA62D9-1805-4F6F-B903-A819AB6A8D45", "versionEndExcluding": "7.2.3", "versionStartIncluding": "7.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:torchbox:wagtail:7.3:-:*:*:*:*:*:*", "matchCriteriaId": "30656B21-90B6-4B64-90F7-F4D1768E99DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:torchbox:wagtail:7.3:rc1:*:*:*:*:*:*", "matchCriteriaId": "85851799-940D-4D01-98DA-15ECF3E8B151", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock. This issue has been patched in versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1."}, {"lang": "es", "value": "Wagtail es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto construido sobre Django. Antes de las versiones 6.3.8, 7.0.6, 7.2.3 y 7.3.1, existe una vulnerabilidad de cross-site scripting (XSS) almacenado al renderizar bloques TableBlock dentro de un StreamField. Un usuario con acceso para crear o editar p\u00e1ginas que contengan bloques TableBlock de StreamField puede establecer atributos de clase especialmente dise\u00f1ados en el bloque que ejecutan c\u00f3digo JavaScript arbitrario cuando se visualiza la p\u00e1gina. Cuando es visualizado por un usuario con privilegios m\u00e1s altos, esto podr\u00eda llevar a realizar acciones con las credenciales de ese usuario. La vulnerabilidad no es explotable por un visitante de sitio ordinario sin acceso al administrador de Wagtail, y solo afecta a los sitios que utilizan TableBlock. Este problema ha sido parcheado en las versiones 6.3.8, 7.0.6, 7.2.3 y 7.3.1."}], "id": "CVE-2026-28222", "lastModified": "2026-06-17T10:28:21.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28222", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T18:05:22.577268Z", "version": "2.0.3"}}]}, "published": "2026-03-05T20:16:15.277", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/wagtail/wagtail/commit/0375094bb57ce6e527005c2bb2e871dd20bca04d"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/wagtail/wagtail/commit/4620423cb22c5253391a0f04178089c1162f6e2e"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/wagtail/wagtail/commit/575c0d7c18c7716ed73f7a3c2720ad75956f0a85"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/wagtail/wagtail/commit/605a5569686565e035313222e1bc2f9802fbc55b"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/wagtail/wagtail/releases/tag/v6.3.8"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/wagtail/wagtail/releases/tag/v7.0.6"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/wagtail/wagtail/releases/tag/v7.2.3"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/wagtail/wagtail/releases/tag/v7.3.1"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.3.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.4rc1,7.0.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1rc1,7.2.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.3rc1,7.3.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wagtail", "source": "cna", "vendor": "wagtail"}, "product": "wagtail", "vendor": "wagtail"}], "analysis": {"en": {"generated_at": "2026-04-17T12:40:36.505312+00:00", "value": {"mitigation_remediation": ["Upgrade Wagtail to a patched version (6.3.8, 7.0.6, 7.2.3, or 7.3.1).", "If an upgrade cannot be performed immediately, restrict the use of the TableBlock block to trusted administrators only, disabling it for all other users to prevent further injection.", "After the upgrade or restriction, audit all existing pages that contain TableBlock blocks and remove any malicious class attributes to eliminate stored XSS payloads."], "summary": {"action": "Patch Now", "impact": "Cross\u2011site scripting that can execute arbitrary JavaScript in privileged user contexts"}, "threat_synthesis": {"affected_systems": "All Wagtail installations using TableBlock and running versions earlier than 6.3.8, 7.0.6, 7.2.3, or 7.3.1 are affected. The vulnerability is limited to sites that employ TableBlock blocks within StreamField content.", "description_and_impact": "Wagtail CMS contains a stored cross\u2011site scripting flaw in the TableBlock class attribute handling. A content editor with permission to create or edit pages can insert specially crafted class names that are rendered without proper escaping, allowing arbitrary JavaScript to run when the page is viewed. If the page is accessed by a user with higher privileges, the injected script may perform actions using that user\u2019s credentials.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 6.1 and an EPSS probability of less than 1\u202f%, indicating a moderate severity with a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires access to the Wagtail admin interface and the ability to edit or create TableBlock content; ordinary site visitors cannot exploit it directly. Once injected, the malicious script can potentially act with the privileges of the browsing user, posing the risk of privilege escalation."}}}}, "created": "2026-03-06T15:01:18.445036+00:00", "updated": "2026-04-17T12:45:16.149254+00:00", "vendors": ["wagtail", "wagtail$PRODUCT$wagtail"]}