Vulnerabilities

TI-2026-22628 CVE-2026-28343 · GHSA-jrqm-vmqc-gm93

CKEditor: Cross-site scripting (XSS) in the HTML Support package

LOW 28

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00319 Published 2026-03-05 Fixed in 47.6.0 CWE-79

TI-2025-37971 CVE-2025-61261 · GHSA-fx2p-cf25-w3gm

A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular…

MEDIUM 58

A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00285 Published 2025-11-07 No fix listed CWE-79

TI-2024-30632 CVE-2024-45613 · GHSA-rgg8-g5x8-wr9v

CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package

LOW 24

CKEditor 5 is a JavaScript rich-text editor.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00524 Published 2024-09-25 Fixed in 43.1.1 CWE-79

TI-2021-04357 CVE-2021-21254 · GHSA-hgmg-hhc8-g5wr

Regular expression Denial of Service in Markdown plugin

LOW 32

CKEditor 5 is an open source rich text editor framework with a modular architecture.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01814 Published 2021-01-29 Fixed in 25.0.0 CWE-400

Vulnerabilities

Filters

CKEditor: Cross-site scripting (XSS) in the HTML Support package

A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular…

CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package

Regular expression Denial of Service in Markdown plugin