CVE Feed

    Dashboard / CVE / CVE-2020-11001

    CVE-2020-11001

    In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

    Published:Apr 14, 2020
    Last Modified:Nov 21, 2024
    EPS:Apr 14, 2020
    EPSS Score:0.00406
    CVSS Score:5.8

    Affected Products

    Vendor
    Torchbox
    Product
    Wagtail

    Exploits

    https://github.com/wagtail/wagtail/security/advisories/GHSA-v2wc-pfq2-5cm6https://github.com/wagtail/wagtail/security/advisories/GHSA-v2wc-pfq2-5cm6

    Related CVEs

    CVE-2026-44201 (CVSS 5.3) — Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Docum…
    CVE-2026-44200 (CVSS 6.5) — Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS use…
    CVE-2026-44199 (CVSS 6.5) — Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS use…
    CVE-2026-44198 (CVSS 4.3) — Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS use…
    CVE-2026-44197 (CVSS 6.5) — Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS use…
    CVE-2026-28222 (CVSS 6.1) — Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, an…
    CVE-2026-28223 (CVSS 6.1) — Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, an…
    CVE-2026-25517 (CVSS 5.1) — Wagtail is an open source content management system built on Django. Prior to versions 6.3.6, 7.0.4, 7.1.3, 7.…
    CVE-2024-39317 (CVSS 6.5) — Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` w…
    CVE-2023-45809 (CVSS 2.7) — Wagtail is an open source content management system built on Django. A user with a limited-permission editor a…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High