CVE-2026-54263

HIGH 7.3

Wagtail: Reflected XSS in dynamic image URL generator view

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.

CWE	CWE-79
Vendor	wagtail
Product	wagtail
Published	Jul 1, 2026

Stay Ahead of the Next One

Get instant alerts for wagtail wagtail

Be the first to know when new high vulnerabilities affecting wagtail wagtail are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

wagtail / wagtail

< 7.0.8 >= 7.1.0, < 7.3.3 >= 7.4.0, < 7.4.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/wagtail/wagtail/security/advisories/GHSA-23m2-mghx-vqmf