Wagtail CMS contains a stored cross‑site scripting flaw in the TableBlock class attribute handling. A content editor with permission to create or edit pages can insert specially crafted class names that are rendered without proper escaping, allowing arbitrary JavaScript to run when the page is viewed. If the page is accessed by a user with higher privileges, the injected script may perform actions using that user’s credentials.

All Wagtail installations using TableBlock and running versions earlier than 6.3.8, 7.0.6, 7.2.3, or 7.3.1 are affected. The vulnerability is limited to sites that employ TableBlock blocks within StreamField content.

The vulnerability carries a CVSS score of 6.1 and an EPSS probability of less than 1 %, indicating a moderate severity with a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires access to the Wagtail admin interface and the ability to edit or create TableBlock content; ordinary site visitors cannot exploit it directly. Once injected, the malicious script can potentially act with the privileges of the browsing user, posing the risk of privilege escalation.