Skip to content
OpenAdvisories

Vendor

ckeditor

21 known vulnerabilities.

Products

ckeditor4 12 ckeditor5 9
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 3.1
    CVE-2026-116687

    CKEditor: Cross-site scripting (XSS) in the engine package

    CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object conten…

    ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm
  • Low 2.3
    CVE-2025-58064

    CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package

    CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting (XSS) vulnerability. Ability to exploit could be triggered b…

    ckeditor ckeditor5 ckeditor5 @ckeditor/ckeditor5-clipboard npm
  • Low 2.3
    CVE-2025-25299

    Cross-site scripting (XSS) in the real-time collaboration package

    CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, …

    ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm
  • Low 3.1
    CVE-2024-43411

    CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover

    CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they c…

    ckeditor ckeditor4 request-tracker4 ldap-account-manager Ubuntu npm