Vulnerability record · CVE-2023-28836 · published 3 April 2023

CVE-2023-28836: Torchbox wagtail cross-site scripting vulnerability

Torchbox · Wagtail

Wagtail is an open source content management system built on Django. Starting in version 1.5 and prior to versions 4.1.4 and 4.2.2, a stored cross-site scripting (XSS) vulnerability exists on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft pages and documents that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites with ModelAdmin enabled. For page, the vulnerability is in the "Choose a parent page" ModelAdmin view (`ChooseParentView`), available when managing pages via ModelAdmin. For documents, the vulnerability is in the ModelAdmin Inspect view (`InspectView`) when displaying document fields. Patched versions have been released as Wagtail 4.1.4 and Wagtail 4.2.2. Site owners who are unable to upgrade to the new versions can disable or override the corresponding functionality.

5.4 CVSS 3.1 Medium EPSS 0.78% · top 45.9% CWE-79 · Cross-site scripting

5.4CVSS 3.1 base score

0.78%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

16References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Wagtail Torchbox

References

Link	Tags
https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#customising-chooseparentview	Product
https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview	Product
https://github.com/wagtail/wagtail/commit/5be2b1ed55fd7259dfdf2c82e7701dba407b8b62	Patch
https://github.com/wagtail/wagtail/commit/bc84bf9815610cfbf8db3b6050c7ddcbaa4b9713	Release Notes
https://github.com/wagtail/wagtail/commit/eefc3381d37b476791610e5d30594fae443f33af	Release Notes
https://github.com/wagtail/wagtail/commit/ff806ab173a504395fdfb3139eb0a29444ab4b91	Patch
https://github.com/wagtail/wagtail/releases/tag/v4.2.2	Release Notes
https://github.com/wagtail/wagtail/security/advisories/GHSA-5286-f2rf-35c2	MitigationVendor Advisory
https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/chooseparentview.html#customising-chooseparentview	Product
https://docs.wagtail.org/en/stable/reference/contrib/modeladmin/inspectview.html#enabling-customising-inspectview	Product
https://github.com/wagtail/wagtail/commit/5be2b1ed55fd7259dfdf2c82e7701dba407b8b62	Patch
https://github.com/wagtail/wagtail/commit/bc84bf9815610cfbf8db3b6050c7ddcbaa4b9713	Release Notes
https://github.com/wagtail/wagtail/commit/eefc3381d37b476791610e5d30594fae443f33af	Release Notes
https://github.com/wagtail/wagtail/commit/ff806ab173a504395fdfb3139eb0a29444ab4b91	Patch
https://github.com/wagtail/wagtail/releases/tag/v4.2.2	Release Notes
https://github.com/wagtail/wagtail/security/advisories/GHSA-5286-f2rf-35c2	MitigationVendor Advisory

Track CVE-2023-28836 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.3CVE-2026-54263Torchbox wagtail cross-site scripting vulnerabilityWagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS…EPSS 0.36%1 Jul 2026 6.8CVE-2020-11001Torchbox wagtail cross-site scripting vulnerabilityIn Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail…EPSS 1.3%14 Apr 2020 6.5CVE-2026-54261Torchbox wagtail vulnerabilityWagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check o…EPSS 0.34%1 Jul 2026 6.5CVE-2026-44199Torchbox wagtail vulnerabilityWagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages cou…EPSS 0.30%11 May 2026 6.5CVE-2026-44200Torchbox wagtail vulnerabilityWagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could co…EPSS 0.34%11 May 2026 6.5CVE-2026-44197Torchbox wagtail vulnerabilityWagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page co…EPSS 0.35%11 May 2026 6.1CVE-2026-28222Torchbox wagtail cross-site scripting vulnerabilityWagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting …EPSS 0.59%5 Mar 2026 6.1CVE-2026-28223Torchbox wagtail cross-site scripting vulnerabilityWagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting …EPSS 0.59%5 Mar 2026

Source: NIST National Vulnerability Database (record CVE-2023-28836), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.