LiveActive security incident?Get immediate response
CVE Record

CVE-2021-32681: Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the `{% include_block %}` template tag is used to output the value of a plain-text StreamField block (`CharBlock`, `TextBlock` or a similar user-defined block derived from `FieldBlock`), and that block does not specify a template for rendering, the tag output is not properly escaped as HTML. This could allow users to insert arbitrary HTML or scripting. This vulnerability is only exploitable by users with the ability to author StreamField content (i.e. users with 'editor' access to the Wagtail admin). Patched versions have been released as Wagtail 2.11.8 (for the LTS 2.11 branch), Wagtail 2.12.5, and Wagtail 2.13.2 (for the current 2.13 branch). As a workaround, site implementors who are unable to upgrade to a current supported version should audit their use of `{% include_block %}` to ensure it is not used to output `CharBlock` / `TextBlock` values with no associated template. Note that this only applies where `{% include_block %}` is used directly on that block (uses of `include_block` on a block _containing_ a CharBlock / TextBlock, such as a StructBlock, are unaffected). In these cases, the tag can be replaced with Django's `{{ ... }}` syntax - e.g. `{% include_block my_title_block %}` becomes `{{ my_title_block }}`.

MediumCVSS 5.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-32681 is a stored cross-site scripting issue in Wagtail CMS. It lets an authenticated editor place HTML or script content through certain plain-text StreamField blocks when a specific template tag is used incorrectly. Public anonymous users are not the initial attacker, but visitors or staff viewing affected pages could be impacted.

Executive priority

Treat this as a moderate-priority CMS hardening item. It is less urgent than unauthenticated remote code execution, but should be scheduled promptly where non-admin editors publish content or public pages render StreamField content.

Technical view

Affected Wagtail versions fail to HTML-escape plain-text StreamField blocks rendered directly with `{% include_block %}` when no block template is configured. The issue affects CharBlock, TextBlock, or similar FieldBlock-derived blocks. Patched versions are 2.11.8, 2.12.5, and 2.13.2.

Likely exposure

Exposure is most likely on Wagtail sites running affected versions and using StreamField content authored by lower-trust editors. Risk depends on whether templates directly render plain-text blocks with `{% include_block %}` and no associated template.

Exploitation context

The source states exploitation requires Wagtail admin editor access. KEV status is false, and the provided sources do not show active exploitation. The business concern is stored script execution through trusted publishing workflows, not unauthenticated remote compromise.

Researcher notes

Scope is narrow: direct include_block rendering of plain-text FieldBlock-derived values without a template. Uses of include_block on containing blocks, such as StructBlock, are described as unaffected by the source bundle.

Mitigation direction

  • Upgrade Wagtail to 2.11.8, 2.12.5, 2.13.2, or later supported versions.
  • Audit templates for direct `{% include_block %}` rendering of CharBlock or TextBlock values.
  • Replace affected direct rendering with Django variable output where vendor guidance says appropriate.
  • Review editor role assignments and remove unnecessary StreamField authoring access.
  • Check current Wagtail vendor guidance before applying alternative mitigations.

Validation and detection

  • Inventory Wagtail versions across production, staging, and maintained legacy deployments.
  • Search templates for direct `{% include_block %}` use on plain-text StreamField blocks.
  • Confirm affected blocks do not rely on missing templates for direct rendering.
  • Review content-author roles to identify who can edit StreamField content.
  • After remediation, verify plain-text block output is escaped in affected page templates.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-32681 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.4CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N2.32.7Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.4Medium
CVSS 3.1 vector shape for CVE-2021-32681Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
wagtailwagtail< 2.11.8, >= 2.12, <= 2.12.4, >= 2.13, <= 2.13.1Listed
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-79 · source CWE mapping

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs