Skip to content
OpenAdvisories

Vendor

ckeditor

21 known vulnerabilities.

Products

ckeditor4 12 ckeditor5 9
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-28343

    CKEditor: Cross-site scripting (XSS) in the HTML Support package

    CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could b…

    ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm
  • Medium 5.1
    CVE-2024-45613

    CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package

    CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, le…

    ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm
  • Medium 6.1
    CVE-2024-43407

    Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability

    CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter …

    ckeditor ckeditor4 ckeditor ckeditor4 Debian Ubuntu npm Packagist
  • Medium 6.1
    CVE-2024-24816 Public exploit

    Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature

    CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in t…

    ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu npm
  • Medium 6.1
    CVE-2024-24815

    CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection

    CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-p…

    ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu npm Packagist
  • Medium 4.7
    CVE-2023-28439

    ckeditor4 plugins vulnerable to cross-site scripting caused by the editor instance destroying process

    CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special condition…

    ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu
  • Medium 5.8
    CVE-2022-31175

    Cross-site scripting caused by the editor instance destroying process in ckeditor5

    CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special c…

    ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm
  • Medium 5.4
    CVE-2022-24728

    Cross-site Scripting in CKEditor4

    CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malf…

    ckeditor ckeditor4 drupal/core request-tracker4 Debian Ubuntu npm Packagist
  • Medium 6.5
    CVE-2022-24729

    Regular expression Denial of Service in dialog plugin

    CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significa…

    ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu
  • Medium 4.6
    CVE-2021-32809

    Arbitrary HTML injection vulnerability in ckeditor

    ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using …

    ckeditor ckeditor4 ckeditor ckeditor Debian Ubuntu npm
  • Medium 6.5
    CVE-2021-21391

    Regular expression Denial of Service in multiple packages

    CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. F…

    ckeditor ckeditor5 ckeditor3 @ckeditor/ckeditor5-engine Ubuntu npm
  • Medium 6.5
    CVE-2021-21254

    Regular expression Denial of Service in Markdown plugin

    CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abus…

    ckeditor ckeditor5 @ckeditor/ckeditor5-markdown-gfm npm