wagtail has 22 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 10 in the last 90 days against 0 in the 90 before. The busiest recent month was August 2026 with 10. The median CVSS is 5.7 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-280 (8).

CVEs per month

Weakness classes

Products

Worst active — by depth score

wagtail vulnerabilities

Wagtail: Improper restriction handling on Documents and Images chosen endpoints

Wagtail: Denial of service via unbounded filter specs in the image preview

Wagtail: Improper permission handling in image preview

Wagtail: Pages translations can be created without page permissions when using simple_translation

Wagtail: Reflected XSS in dynamic image URL generator view

Wagtail: Improper restriction handling on Pages admin API

Wagtail: Identification of documents by SHA1 hash

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

Wagtail: Improper permission handling when copying snippets

Wagtail: Improper restriction handling on Page translation API endpoint

Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface

Wagtail has improper permission handling on admin preview endpoints

Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`

Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views

Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

Cross-site Scripting in wagtail

Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

Cross-Site Scripting in Wagtail

Potential Observable Timing Discrepancy in Wagtail

Possible XSS attack in Wagtail