Read the docs
TI-2020-08875 Aliases CVE-2020-11001GHSA-v2wc-pfq2-5cm6

Possible XSS attack in Wagtail

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

Why it matters now

EPSS 0.01273 70th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed wagtail (wagtail): 2.7.2, 2.8.1wagtail (PyPI): 2.7.2, 2.8.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
wagtailwagtailbefore 2.7.2; 2.8.0 to before 2.8.12.7.2, 2.8.1Patch availableCNA
—wagtail (PyPI)1.9.0 to before 2.7.22.7.2Patch availableGHSA-v2wc-pfq2-5cm6
—wagtail (PyPI)2.8.0 to before 2.8.12.8.1Patch availableGHSA-v2wc-pfq2-5cm6
  • wagtail Vendorwagtail Affected before 2.7.2; 2.8.0 to before 2.8.1 Fixed in 2.7.2, 2.8.1 Patch available CNA
  • wagtail (PyPI) Vendor— Affected 1.9.0 to before 2.7.2 Fixed in 2.7.2 Patch available GHSA-v2wc-pfq2-5cm6
  • wagtail (PyPI) Vendor— Affected 2.8.0 to before 2.8.1 Fixed in 2.8.1 Patch available GHSA-v2wc-pfq2-5cm6

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*1.9 – 2.7.1Vulnerablewagtail
cpe:2.3:a:torchbox:wagtail:2.8:*:*:*:*:*:*:*2.8Vulnerablewagtail
  • cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:* Versions 1.9 – 2.7.1 Vulnerable ·wagtail
  • cpe:2.3:a:torchbox:wagtail:2.8:*:*:*:*:*:*:* Versions 2.8 Vulnerable ·wagtail

Remediation

  • Fix · CNA wagtail (wagtail) Fixed in 2.7.2, 2.8.1
  • Fix · GHSA-v2wc-pfq2-5cm6 wagtail (PyPI) Fixed in 2.7.2 Advisory →
  • Fix · GHSA-v2wc-pfq2-5cm6 wagtail (PyPI) Fixed in 2.8.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11001
  2. 2026-10-03 Alias added: GHSA-v2wc-pfq2-5cm6

References

Exploit 1

Advisory 1

Other 3

  • TI-2026-39163 Wagtail: Reflected XSS in dynamic image URL generator view CVSS 3.1HIGH 7.3
  • TI-2023-13342 Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views CVSS 3.1MEDIUM 6.4
  • TI-2026-32180 Wagtail: Improper restriction handling on Documents and Images API CVSS 3.1MEDIUM 5.3
  • TI-2026-22558 Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface CVSS 3.1MEDIUM 6.1
  • TI-2026-22557 Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes CVSS 3.1MEDIUM 6.1
  • TI-2024-26273 Wagtail regular expression denial-of-service via search query parsing CVSS 3.1MEDIUM 6.5
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences