CVE-2026-54263
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk10th percentile — higher than 10% of all known CVEs
Summary
In Wagtail, a Django-based CMS, versions prior to 7.0.8, 7.3.3, and 7.4.2 contain a reflected XSS vulnerability in the dynamic image URL generator view within the admin interface. A low-privileged editor can craft a malicious URL that, when viewed by an admin, executes actions with the admin's credentials.
Risk Assessment
The risk is privilege escalation – an attacker with low privileges can take over an admin account, leading to unauthorized data access and content modification.
Recommendation
Upgrade Wagtail to version 7.0.8, 7.3.3, or 7.4.2 immediately. Restricting admin panel access to trusted users reduces exploitation risk.
Original NVD description (English source)
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.