CVE-2026-28223: 
Python vulnerability analysis and mitigation

CVE-2026-28223 is a stored Cross-Site Scripting (XSS) vulnerability in the wagtail.contrib.simple_translation module of the Wagtail CMS. An authenticated admin user can create a page with a specially-crafted title containing malicious JavaScript; when another admin user performs the "Translate" action, the script executes in their browser context. Affected versions include Wagtail before 6.3.8, 6.4.x through 7.0.5, 7.1.x through 7.2.2, and 7.3/7.3-rc1. It was disclosed on March 3, 2026, with a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause (CWE-79) is improper neutralization of user-controlled input in confirmation/warning/error messages rendered in the Wagtail admin interface. Specifically, the base.html template used the Django |safe filter when rendering flash messages, bypassing HTML escaping — and the simple_translation views passed page titles directly into these messages via django.contrib.messages rather than the safer wagtail.admin.messages module. An attacker with admin access crafts a page title containing a JavaScript payload (e.g., <img src=x onerror=alert(4242)>), which is stored in the database and rendered unescaped in the confirmation message shown to any admin who triggers the "Translate" action on that page (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser session of another Wagtail admin user, potentially leading to session hijacking, credential theft, and unauthorized actions performed under the victim's privileges. Both confidentiality and integrity are rated High, as the attacker could exfiltrate session tokens or make administrative changes on behalf of the victim. Availability is not impacted. The vulnerability is confined to the Wagtail admin area and is not exploitable by ordinary site visitors (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.046% (14th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to already hold Wagtail admin credentials and requires a second admin user to perform the "Translate" action on the malicious page (GitHub Advisory).

1. Gain Admin Access: Obtain or already possess credentials for a Wagtail admin account with page creation privileges.
2. Craft Malicious Page Title: Create or edit a Wagtail page and set its title to a JavaScript payload, e.g., <img src=x onerror=alert(document.cookie)>. Save the page.
3. Wait for Victim Interaction: Wait for another admin user to navigate to the page in the Wagtail admin and initiate the "Translate" action via the simple_translation module (e.g., by visiting the submit translation URL: /admin/simple_translation/submit_page_translation/<page_id>/).
4. Payload Execution: When the victim submits the translation form, the confirmation message — which includes the unescaped page title — is rendered in base.html using the |safe filter, causing the injected JavaScript to execute in the victim's browser.
5. Achieve Objective: The executed script can exfiltrate the victim's session cookie, perform admin actions via AJAX requests using the victim's authenticated session, or redirect the victim to an attacker-controlled page (GitHub Advisory, Patch Commit).

• Logs: Wagtail admin access logs showing POST requests to /admin/simple_translation/submit_page_translation/<id>/ followed by unusual outbound network activity from the admin user's browser session.
• Database/Content: Pages in the Wagtail database with titles containing HTML tags or JavaScript constructs (e.g., <script>, <img src=x onerror=, javascript:) — query the wagtailcore_page table for anomalous title or draft_title values.
• Network: Unexpected outbound HTTP requests from admin users' browsers to external domains shortly after performing translation actions, potentially carrying encoded session tokens or cookies.
• Logs: Wagtail audit log entries showing page creation or editing by one admin account followed by translation actions by a different admin account on the same page.

Wagtail has released patched versions: 6.3.8, 7.0.6, 7.2.3, and 7.3.1. The fix enforces HTML escaping of all confirmation, warning, and error messages by routing them through wagtail.admin.messages and removing the |safe filter from base.html. No workarounds are available; upgrading to a patched version is the only remediation. As an interim measure, consider restricting the simple_translation module to the minimum number of trusted admin users, or disabling it entirely if not actively needed (GitHub Advisory, Patch Commit).

The vulnerability was reported by Guan Chenxian (@GCXWLP) and remediated by the Wagtail core team (gasman). The advisory was published directly to the GitHub Advisory Database on March 3, 2026, and the fix was reviewed by RealOrangeOne. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (GitHub Advisory).