TI-2014-04240 Aliases CVE-2014-5191 GHSA-v27h-j97p-wqmx

Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor…

LOW 24CWE-79Published 2014-08-07 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · Partial · None
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Why it matters now

EPSS 0.01834 79th percentileScored 2026-11-07

Fix Fixed ckeditor/ckeditor (Packagist): 4.4.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	ckeditor/ckeditor (Packagist)	before 4.4.3	4.4.3	Patch available	GHSA-v27h-j97p-wqmx

— Vendor— Affected all versions Fixed in — No fix listed CNA
ckeditor/ckeditor (Packagist) Vendor— Affected before 4.4.3 Fixed in 4.4.3 Patch available GHSA-v27h-j97p-wqmx

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:ckeditor:ckeditor::::::::	up to 4.4.2	Vulnerable	ckeditor
cpe:2.3:a:ckeditor:ckeditor:4.4.0:::::::*	4.4.0	Vulnerable	ckeditor
cpe:2.3:a:ckeditor:ckeditor:4.4.1:::::::*	4.4.1	Vulnerable	ckeditor

cpe:2.3:a:ckeditor:ckeditor:*:*:*:*:*:*:*:* Versions up to 4.4.2 Vulnerable ·ckeditor
cpe:2.3:a:ckeditor:ckeditor:4.4.0:*:*:*:*:*:*:* Versions 4.4.0 Vulnerable ·ckeditor
cpe:2.3:a:ckeditor:ckeditor:4.4.1:*:*:*:*:*:*:* Versions 4.4.1 Vulnerable ·ckeditor

Remediation

Fix · GHSA-v27h-j97p-wqmx ckeditor/ckeditor (Packagist) Fixed in 4.4.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2014-5191
2026-10-03 Alias added: GHSA-v27h-j97p-wqmx

References

Patch 1

http://ckeditor.com/node/136981

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2014-5191

Other 2

TI-2023-15111 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’… CVSS 3.1CRITICAL 9.8
TI-2021-18004 HTML comments vulnerability allowing to execute JavaScript code CVSS 3.1HIGH 8.2
TI-2022-08543 Regular expression Denial of Service in dialog plugin CVSS 3.1HIGH 7.5
TI-2021-18003 Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML CVSS 3.1HIGH 8.2
TI-2021-12473 Cross-site scripting in ckeditor via abuse of undo functionality CVSS 3.1HIGH 7.6
TI-2011-04280 Information disclosure in CKSource CKEditor Drupal module CVSS 3.1HIGH 7.5

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences