Skip to content
OpenAdvisories

Product · ckeditor

ckeditor5

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 3.1
    CVE-2026-116687

    CKEditor: Cross-site scripting (XSS) in the engine package

    CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object conten…

    ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm
  • Low 2.3
    CVE-2025-58064

    CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package

    CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting (XSS) vulnerability. Ability to exploit could be triggered b…

    ckeditor ckeditor5 ckeditor5 @ckeditor/ckeditor5-clipboard npm
  • Low 2.3
    CVE-2025-25299

    Cross-site scripting (XSS) in the real-time collaboration package

    CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, …

    ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm