Skip to content
OpenAdvisories

Package · Ubuntu

ckeditor

22 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-28343

    CKEditor: Cross-site scripting (XSS) in the HTML Support package

    CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could b…

    ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm
  • Medium 5.4
    CVE-2025-61261

    A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute …

    request-tracker4 ldap-account-manager ckeditor ckeditor3 Ubuntu
  • Medium 6.1
    CVE-2024-24816 Public exploit

    Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature

    CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in t…

    ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu npm
  • Medium 6.1
    CVE-2024-24815

    CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection

    CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-p…

    ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu npm Packagist
  • Medium 6.1
    CVE-2023-4771

    Cross-Site Scripting vulnerability in CKSource CKEditor

    A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.

    CKSource CKEditor request-tracker4 ldap-account-manager Debian Ubuntu npm
  • Medium 4.7
    CVE-2023-28439

    ckeditor4 plugins vulnerable to cross-site scripting caused by the editor instance destroying process

    CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special condition…

    ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu
  • Medium 5.4
    CVE-2022-24728

    Cross-site Scripting in CKEditor4

    CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malf…

    ckeditor ckeditor4 drupal/core request-tracker4 Debian Ubuntu npm Packagist
  • Medium 4.6
    CVE-2021-32809

    Arbitrary HTML injection vulnerability in ckeditor

    ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using …

    ckeditor ckeditor4 ckeditor ckeditor Debian Ubuntu npm
  • Medium 6.1
    CVE-2021-33829

    ckeditor4 vulnerable to cross-site scripting

    A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.

    drupal/core drupal/drupal ckeditor ckeditor Debian Ubuntu npm Packagist
  • Medium 6.5
    CVE-2021-26272

    Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4

    It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).

    ckeditor ckeditor ckeditor4 Debian Ubuntu npm
  • Medium 6.5
    CVE-2021-26271

    CKEditor 4 ReDoS Vulnerability

    It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).

    ckeditor ckeditor ckeditor4-dev Debian Ubuntu npm
  • Medium 6.1
    CVE-2020-9281

    CKEditor 4.0 vulnerability in the HTML Data Processor

    A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

    ckeditor ckeditor4 Ubuntu npm
  • Medium 6.1
    CVE-2018-17960

    Ckeditor XSS Vulnerability

    CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

    typo3/cms typo3/cms-core ckeditor ckeditor Debian Ubuntu npm Packagist
  • Medium 6.1
    CVE-2018-9861

    Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)

    Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject a…

    drupal/core drupal/drupal ckeditor ckeditor-dev Ubuntu npm Packagist