A stored cross‑site scripting flaw exists in Wagtail's simple_translation module. The vulnerability is triggered when an administrator creates a page with a specially‑crafted title that is then displayed in a confirmation message during a translation action. When the message is rendered, the unsanitized title can contain arbitrary JavaScript that executes in the context of the other admin users who view the message, potentially allowing the attacker to perform actions with their credentials.

Wagtail instances running any 6.x or 7.x release older than 6.3.8, 7.0.6, 7.2.3, or 7.3.1 and that use the wagtail.contrib.simple_translation module are affected. Administrators should verify the installation version and the presence of this module.

The CVSS score of 6.1 denotes a medium severity. An EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires access to the admin interface, so it cannot be triggered by a regular site visitor. Nevertheless, any compromised admin account could execute unauthorized code and potentially elevate privileges or tamper with content.