Vulnerabilities

TI-2026-81521 CVE-2026-116688 · GHSA-rh54-vffm-5fvp

Cross-site scripting in CKEditor 5 engine package

LOW 38

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00497 Published 2026-10-27 Fixed in 47.7.4, 48.5.1 CWE-79

TI-2026-81520 CVE-2026-116687 · GHSA-v6mg-96c6-gmpq

Cross-site scripting in CKEditor 5 engine package

LOW 15

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00252 Published 2026-10-27 Fixed in 47.7.4, 48.5.1 CWE-79

TI-2026-22628 CVE-2026-28343 · GHSA-jrqm-vmqc-gm93

CKEditor: Cross-site scripting (XSS) in the HTML Support package

LOW 28

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00319 Published 2026-03-05 Fixed in 47.6.0 CWE-79

TI-2025-37971 CVE-2025-61261 · GHSA-fx2p-cf25-w3gm

A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular…

MEDIUM 58

A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00285 Published 2025-11-07 No fix listed CWE-79

TI-2025-35907 CVE-2025-58064 · GHSA-x9gp-vjh6-3wv6

CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package

LOW 12

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00417 Published 2025-09-03 Fixed in 46.0.3, 45.2.2 CWE-79

TI-2025-18953 CVE-2025-25299 · GHSA-j3mm-wmfm-mwvh

Cross-site scripting (XSS) in the real-time collaboration package

LOW 19

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00603 Published 2025-02-20 Fixed in 44.2.1 CWE-79

TI-2024-30632 CVE-2024-45613 · GHSA-rgg8-g5x8-wr9v

CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package

LOW 24

CKEditor 5 is a JavaScript rich-text editor.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00524 Published 2024-09-25 Fixed in 43.1.1 CWE-79

TI-2024-29060 CVE-2024-43411 · GHSA-6v96-m24v-f58j

CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover

LOW 16

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.

CVSS 3.1LOW 3.1 Network High privileges User interaction EPSS 0.00427 Published 2024-08-21 Fixed in 4.25.0-lts, 4.25.0 CWE-79

TI-2024-29056 CVE-2024-43407 · GHSA-7r32-vfj5-c2jv

Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability

LOW 28

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0045 Published 2024-08-21 Fixed in 4.25.0-lts, 4.25.0 CWE-79

TI-2024-16333 CVE-2024-24816 · GHSA-mw2c-vx6j-mg76

Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature

LOW 31

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01652 Published 2024-02-07 Fixed in 4.24.0-lts CWE-79

TI-2024-16332 CVE-2024-24815 · GHSA-fq6h-4g8v-qqvm

CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection

LOW 28

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00706 Published 2024-02-07 Fixed in 4.24.0-lts, 4.24.0 CWE-79

TI-2023-15111 CVE-2023-31541 · GHSA-w4w8-q6pw-hgxq

A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’…

HIGH 82

A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01431 Published 2023-06-13 No fix listed CWE-434

TI-2023-12983 CVE-2023-28439

ckeditor4 plugins vulnerable to cross-site scripting caused by the editor instance destroying process

LOW 28

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00725 Published 2023-03-22 Fixed in 4.21.0 CWE-79

TI-2022-23810 CVE-2022-48110

CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS)…

LOW 31

CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02097 Published 2023-02-13 No fix listed CWE-79

TI-2022-13215 CVE-2022-31175 · GHSA-42wq-rch8-6f6j

Cross-site scripting caused by the editor instance destroying process in ckeditor5

LOW 28

CKEditor 5 is a JavaScript rich text editor.

CVSS 3.1MEDIUM 5.8 Network No auth User interaction EPSS 0.00883 Published 2022-08-03 Fixed in 35.0.1 CWE-79

TI-2022-08543 CVE-2022-24729

Regular expression Denial of Service in dialog plugin

LOW 38

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02487 Published 2022-03-16 Fixed in 4.18.0 CWE-400

TI-2022-08542 CVE-2022-24728 · GHSA-4fc4-4p5g-6w89

Cross-site Scripting in CKEditor4

LOW 27

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01203 Published 2022-03-16 Fixed in 4.18.0 CWE-79

TI-2021-18004 CVE-2021-41165 · GHSA-7h26-63m7-qhf2

HTML comments vulnerability allowing to execute JavaScript code

LOW 39

CKEditor4 is an open source WYSIWYG HTML editor.

CVSS 3.1HIGH 8.2 Network Low privileges User interaction EPSS 0.01573 Published 2021-11-17 Fixed in 4.17.0 CWE-79

TI-2021-18003 CVE-2021-41164 · GHSA-pvmx-g8h5-cprj

Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML

LOW 38

CKEditor4 is an open source WYSIWYG HTML editor.

CVSS 3.1HIGH 8.2 Network Low privileges User interaction EPSS 0.01346 Published 2021-11-17 Fixed in 4.17.0 CWE-79

TI-2021-15570 CVE-2021-37695 · GHSA-m94c-37g6-cjhc

Execution of JavaScript code using malformed HTML in ckeditor

LOW 35

ckeditor is an open source WYSIWYG HTML editor with rich content support.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.01318 Published 2021-08-12 Fixed in 4.16.2 CWE-79

TI-2021-12474 CVE-2021-32809 · GHSA-7889-rm5j-hpgg

Arbitrary HTML injection vulnerability in ckeditor

LOW 27

ckeditor is an open source WYSIWYG HTML editor with rich content support.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01188 Published 2021-08-12 Fixed in 4.16.2 CWE-94

TI-2021-12473 CVE-2021-32808 · GHSA-6226-h7ff-ch6c

Cross-site scripting in ckeditor via abuse of undo functionality

LOW 36

ckeditor is an open source WYSIWYG HTML editor with rich content support.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.01192 Published 2021-08-12 Fixed in 4.16.2 CWE-79

TI-2021-13179 CVE-2021-33829 · GHSA-rgx6-rjj4-c388

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4…

LOW 33

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!>…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.03189 Published 2021-06-09 Fixed in 4.16.1, 7.80 +3 CWE-79

TI-2021-04490 CVE-2021-21391 · GHSA-3rh3-wfr4-76mj

Regular expression Denial of Service in multiple packages

LOW 32

CKEditor 5 provides a WYSIWYG editing solution.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01667 Published 2021-04-29 Fixed in 27.0.0 CWE-400

TI-2021-04357 CVE-2021-21254 · GHSA-hgmg-hhc8-g5wr

Regular expression Denial of Service in Markdown plugin

LOW 32

CKEditor 5 is an open source rich text editor framework with a modular architecture.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01814 Published 2021-01-29 Fixed in 25.0.0 CWE-400

Vulnerabilities

Filters