The short answer: yes, on two conditions, an up-to-date site and protected admin accounts. Wagtail inherits Django's protection against the classic attacks, publishes its security advisories together with the fix, and has no third-party plugin ecosystem, the source of 91% of WordPress vulnerabilities in 2025. It still publishes advisories: ten in 2026 as of 18 September, all limited to users already logged into the admin. The facts below were checked on 18 September 2026.
What Wagtail protects by construction
Wagtail is built on Django, a Python development framework used since 2005 by very high-traffic websites. Django ships with protection against the most common attacks: code injection through forms (XSS), request forgery (CSRF), database injection (SQL), session hijacking. A Wagtail site gets it without installing anything, and Django's own fixes follow a public calendar.
The second protection is an architecture choice: on a custom Wagtail site, only the code written for your project runs in production. No downloaded theme, no extensions maintained by strangers. Less code, fewer doors.
Wagtail's security advisories in 2026
A serious CMS is not one without flaws; it is one that looks for them, fixes them and announces them. As of 18 September 2026, the project has published ten advisories for the year (official list): five on 15 June and five on 20 August, eight of moderate severity, one low, one high. The only high one (CVE-2026-54263) concerned an injection in an admin page and was fixed in versions 7.0.8, 7.3.3 and 7.4.2 before the advisory was published.
What the ten have in common: they require an account in the site's admin. None can be exploited by an anonymous visitor. They mostly protect a site against a malicious editor or a compromised account, which brings us back to the first condition: protected accounts, with strong passwords and two-factor authentication, and rights limited to what each editor strictly needs.
Wagtail's code has also been audited against the OWASP standards (Top 10 and Code Review Guide) by independent auditors commissioned by the DINUM, the French State's digital directorate, which made Wagtail the base of its public websites (the project's security page).
The comparison with WordPress, in figures
The 2026 report by Patchstack counts 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42%: 91% in plugins, 9% in themes, six in the core, all low priority. 1,966 were rated high severity, and 46% had no fix when they were published. The WordPress core is well maintained; the risk comes from what gets added to it. A Wagtail site has no such layer. The full comparison is in Wagtail vs WordPress.
The three conditions of a secure Wagtail site
- A maintained version. Fixes are only published for supported versions: 7.4 LTS until 2 November 2027, 7.0 LTS until 2 November 2026. A site on 6.3 LTS has not been fixed since 1 May 2026. See which version to choose.
- Protected accounts. Strong passwords, two-factor authentication, rights limited by role, accounts removed when someone leaves the organisation. That is where the ten 2026 advisories play out.
- Well-kept hosting. Up-to-date system, tested backups, HTTPS encryption, security headers, monitoring. The CMS does not replace the host.
This is the contract we apply to the sites we host: an upgrade at each LTS, accounts reviewed with the client, and hosting we administer ourselves. If you want to know where your site stands, describe it to us.