{"cve":"CVE-2020-11001","nvd":{"published":"2020-04-14T23:15:11.917","modified":"2026-06-17T02:48:50.067","status":"Modified","description":"In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision\ncomparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail\nadmin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform\nactions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to\nthe Wagtail admin.\n\nPatched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","score":6.8},"cwes":["CWE-79","CWE-80"],"references":["https://github.com/wagtail/wagtail/security/advisories/GHSA-v2wc-pfq2-5cm6","https://github.com/wagtail/wagtail/commit/61045ceefea114c40ac4b680af58990dbe732389","https://github.com/wagtail/wagtail/releases/tag/v2.8.1","https://github.com/wagtail/wagtail/security/advisories/GHSA-v2wc-pfq2-5cm6"],"products":["torchbox:wagtail"],"source":"nvd","synced_at":"2026-10-19T21:03:08.679916934+00:00"},"epss":{"cve":"CVE-2020-11001","score":0.01273,"percentile":0.69895,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-v2wc-pfq2-5cm6","url":"https://osv.dev/vulnerability/GHSA-v2wc-pfq2-5cm6","summary":"Possible XSS attack in Wagtail","modified":"2026-09-10T03:48:43.980839606Z","packages":[{"ecosystem":"PyPI","name":"wagtail","purl":"pkg:pypi/wagtail","ranges":[">=1.9.0 <2.7.2"],"fixed":["2.7.2"]},{"ecosystem":"PyPI","name":"wagtail","purl":"pkg:pypi/wagtail","ranges":[">=2.8.0 <2.8.1"],"fixed":["2.8.1"]}]},{"id":"PYSEC-2020-152","url":"https://osv.dev/vulnerability/PYSEC-2020-152","summary":"","modified":"2023-11-08T04:02:02.747979Z","packages":[{"ecosystem":"PyPI","name":"wagtail","purl":"pkg:pypi/wagtail","ranges":[">=1.9 <2.7.2"],"fixed":["2.7.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}