What is the CVSS score of CVE-2026-54263?

CVE-2026-54263 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Wagtail CMS are affected by CVE-2026-54263?

Wagtail Django CMS versions prior to 7.0.8, 7.3.3, and 7.4.2 contain a reflected cross-site scripting vulnerability in the admin interface that allows low-privilege editors to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-54263?

24 hours: Identify all systems running Wagtail versions prior to 7.0.8, 7.3.3, or 7.4.2; audit recent admin activity logs for suspicious URL access patterns. 7 days: Upgrade to Wagtail 7.0.8 (for 7.0.x deployments), 7.3.3 (for 7.3.x), or 7.4.2 (for 7.4.x). 30 days: Review admin-level account permissions for all low-privilege editor accounts; conduct forensic review of admin action logs for the past 90 days to detect unauthorized administrative activity.

Wagtail CMS CVE-2026-54263

EUVD-2026-41150 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 GitHub_M

GHSA-23m2-mghx-vqmf PYSEC-2026-616

XSS Python Wagtail

7.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

5.4 MEDIUM

Editor account needed (PR:L) and an admin victim must click the link (UI:R); reflected XSS executes in the admin's session so S:C, with limited confidentiality/integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 01, 2026 - 23:02 EUVD

Analysis Generated

Jul 01, 2026 - 22:22 vuln.today

DescriptionCVE.org

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.

Articles & Coverage 1

News 3 New Python Vulnerabilities - 3 High Severity, 1 With POC Jul 02, 2026

AnalysisAI

Reflected cross-site scripting in the Wagtail Django CMS admin interface lets a low-privilege editor craft a malicious URL that executes JavaScript in the browser of a higher-privilege administrator who opens it, enabling actions to be performed with the victim's credentials. All Wagtail installations before 7.0.8, 7.3.3 and 7.4.2 are affected - the flaw lives in the dynamic image URL generator view and exists even on sites that never enabled the dynamic image serve view. No public exploit identified at time of analysis, and the issue is not reachable by anonymous site visitors without a Wagtail admin account.

Technical ContextAI

Wagtail is a widely used open-source content management system built on the Django web framework (Python). The defect is classified CWE-79 (Improper Neutralization of Input During Web Page Generation), a reflected XSS in which attacker-controlled input reaching the dynamic image URL generator view within the admin is echoed into an HTML response without adequate output encoding, so the browser interprets it as active script. Because the vulnerable code path is part of the core admin image-serving machinery rather than the optional public 'dynamic image serve view', it is present regardless of whether that public feature is configured. The CPE cpe:2.3:a:wagtail:wagtail:*:*:*:*:*:*:*:* confirms the Wagtail package itself is the affected component across all versions below the fixed releases.

RemediationAI

Vendor-released patch: upgrade to Wagtail 7.0.8, 7.3.3, or 7.4.2 depending on your current release line (choose the patched version matching your major.minor branch), as documented in advisory GHSA-23m2-mghx-vqmf (https://github.com/wagtail/wagtail/security/advisories/GHSA-23m2-mghx-vqmf). If immediate upgrade is not possible, reduce exposure by tightening who holds Wagtail admin editor accounts and reviewing account provisioning, since exploitation requires an authenticated low-privilege editor; you can also restrict network access to the /admin interface to trusted IPs or VPN to limit both attacker submission and victim exposure. A properly scoped Content-Security-Policy on admin responses that restricts inline script execution can blunt reflected XSS as a defense-in-depth control, though it may break admin functionality relying on inline scripts and should be tested first. Note that disabling the public dynamic image serve view does NOT mitigate this issue, since the flaw is present regardless of that setting.