Every CVE Search/ Get API key

CVE-2020-11001

Possible XSS attack in Wagtail

5.8 MediumFix available

In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.27%Up 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.8

Possible XSS attack in Wagtail

In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

Record
CVE-2020-11001
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-80, CWE-79
Updated
2026-11-02
EUVDEUVD-2020-0235 5.8

In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

Record
EUVD-2020-0235
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-v2wc-pfq2-5cm6 4.6

Possible XSS attack in Wagtail

Impact

A cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

Workarounds

Site owners who are unable to upgrade to the new versions can disable the revision comparison view by adding the following URL route to the top of their project's urls.py configuration:

from django.views.generic.base import RedirectView

urlpatterns = [
    url(r'^admin/pages/(\d+)/revisions/compare/', RedirectView.as_view(url='/admin/')),
    # ...
]

Acknowledgements

Many thanks to Vlad Gerasimenko for reporting this issue.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-v2wc-pfq2-5cm6
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-79, CWE-80
Updated
2026-11-02
NVD 5.8

In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

Record
CVE-2020-11001
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-79, CWE-80
Updated
2026-11-02
OSV 6.8

In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

Record
CVE-2020-11001
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-v2wc-pfq2-5cm6 4.6

Possible XSS attack in Wagtail

Impact

A cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

Workarounds

Site owners who are unable to upgrade to the new versions can disable the revision comparison view by adding the following URL route to the top of their project's urls.py configuration:

from django.views.generic.base import RedirectView

urlpatterns = [
    url(r'^admin/pages/(\d+)/revisions/compare/', RedirectView.as_view(url='/admin/')),
    # ...
]

Acknowledgements

Many thanks to Vlad Gerasimenko for reporting this issue.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-v2wc-pfq2-5cm6
CVSS 4.0
4.6 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-79, CWE-80
Updated
2026-11-02
OSVPYSEC-2020-152 No score

In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

Record
PYSEC-2020-152
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wagtail
PyPI
 1.9.0 up to 2.7.2
2.7.2
wagtail
PyPI
 2.8.0 to 2.8.0
2.8.1
wagtail
PyPI
 1.9.0 up to 2.7.2, plus listed versions
1.101.10.11.10rc11.111.11.1
Show 45 moreShow less
1.11rc11.121.12.11.12.21.12.31.12.41.12.51.12.61.12rc11.131.13.11.13.21.13.31.13.41.13rc11.91.9.12.02.0.12.0.22.0b12.0rc12.12.1.12.1.22.1.32.1rc12.1rc22.22.2.12.2.22.2rc12.2rc22.32.3rc12.3rc22.42.4rc12.52.5.12.5.22.5rc12.62.6.12.6.2
2.7.2
wagtail
PyPI
 2.8.0 up to 2.8.1, plus listed versions
2.8
2.8.1
wagtail
PyPI
 1.9 up to 2.7.2, plus listed versions
1.9.11.10rc11.101.10.11.11rc1
Show 45 moreShow less
1.111.11.11.12rc11.121.12.11.12.21.12.31.12.41.12.51.12.61.13rc11.131.13.11.13.21.13.31.13.42.0b12.0rc12.02.0.12.0.22.1rc12.1rc22.12.1.12.1.22.1.32.2rc12.2rc22.22.2.12.2.22.3rc12.3rc22.32.4rc12.42.5rc12.52.5.12.5.22.6rc12.62.6.12.6.2
2.7.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-11001 is a medium vulnerability (CVSS 5.8) in Torchbox Wagtail, published April 14, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 70th percentile. Fixed in wagtail 2.7.2.

References

This page doesn't list everything

Left out here: 11 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open