| Package | Affected versions | Patched versions |
|---|---|---|
| wagtail | ≥ 6.4, < 7.0.6≥ 6.4rc1, < 7.0.6≥ 7.1, < 7.2.3≥ 7.1rc1, < 7.2.3≥ 7.3rc1, < 7.3.1< 6.3.8 | 7.0.67.2.37.3.16.3.8 |
| wagtail | = 7.3≥ 6.4, < 7.0.6≥ 7.1, < 7.2.3< 6.3.8 | 7.0.67.2.36.3.8 |
A stored Cross-site Scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.
None
Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.
If there are any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free