CVE-2026-93456: Batiste Django-Page-CMS

High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days.

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.

Affected products

• Batiste Django-Page-CMS: up to and including 2.0.13

Published 2026-09-18. Last modified 2026-09-22.