CVE-2026-28222

Description

Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm
• https://nvd.nist.gov/vuln/detail/CVE-2026-28222
• https://github.com/wagtail/wagtail/commit/0375094bb57ce6e527005c2bb2e871dd20bca04d
• https://github.com/wagtail/wagtail/commit/4620423cb22c5253391a0f04178089c1162f6e2e
• https://github.com/wagtail/wagtail/commit/575c0d7c18c7716ed73f7a3c2720ad75956f0a85
• https://github.com/wagtail/wagtail/commit/605a5569686565e035313222e1bc2f9802fbc55b
• https://github.com/wagtail/wagtail
• https://github.com/wagtail/wagtail/releases/tag/v6.3.8
• https://github.com/wagtail/wagtail/releases/tag/v7.0.6
• https://github.com/wagtail/wagtail/releases/tag/v7.2.3
• https://github.com/wagtail/wagtail/releases/tag/v7.3.1

💬 Discuss CVE-2026-28222 on VIR Community →

Community-verified mitigations for this CVE will appear above when contributors publish them.