Ckeditor
37 CVEs across 16 Ckeditor products. Browse Ckeditor vulnerabilities, severities, and proof-of-concept exploits.
Ckeditor products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28343 | Medium | 6.4 | 2026-03-05 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XS… |
CVE-2025-61261 | Medium | 5.4 | 2025-11-07 | A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user'… |
CVE-2025-58064 | | 2025-09-04 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 throug… | |
CVE-2025-25299 | | 2025-02-20 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was dis… | |
CVE-2024-45613 | Medium | 6.1 | 2024-09-25 | CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in t… |
CVE-2024-43411 | Low | 3.1 | 2024-08-21 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly… |
CVE-2024-43407 | Medium | 6.1 | 2024-08-21 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. Th… |
CVE-2024-24816 | Medium | 6.1 | 2024-02-07 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior… |
CVE-2024-24815 | Medium | 6.1 | 2024-02-07 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module… |
CVE-2023-31541 | Critical | 9.8 | 2023-06-13 | A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbit… |
CVE-2023-28439 | Medium | 4.7 | 2023-03-22 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Medi… |
CVE-2022-48110 | Medium | 6.1 | 2023-02-13 | CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's posi… |
CVE-2022-31175 | Medium | 5.8 | 2022-08-03 | CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in version… |
CVE-2022-24729 | Medium | 6.5 | 2022-03-16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vu… |
CVE-2022-24728 | Medium | 5.4 | 2022-03-16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all… |
CVE-2021-41165 | High | 8.2 | 2021-11-17 | CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all… |
CVE-2021-41164 | High | 8.2 | 2021-11-17 | CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may a… |
CVE-2021-37695 | High | 7.3 | 2021-08-13 | ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ck… |
CVE-2021-32809 | Medium | 4.6 | 2021-08-12 | ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckedi… |
CVE-2021-32808 | High | 7.6 | 2021-08-12 | ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside… |
CVE-2021-33829 | Medium | 6.1 | 2021-06-09 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject execu… |
CVE-2021-21391 | Medium | 6.5 | 2021-04-29 | CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list… |
CVE-2021-21254 | Medium | 6.5 | 2021-01-29 | CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before v… |
CVE-2021-26272 | Medium | 6.5 | 2021-01-26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then pr… |
CVE-2021-26271 | Medium | 6.5 | 2021-01-26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dia… |
CVE-2020-27193 | Medium | 6.1 | 2020-11-12 | A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading… |
CVE-2020-9440 | Medium | 6.1 | 2020-03-10 | A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAM… |
CVE-2020-9281 | Medium | 6.1 | 2020-03-07 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script throu… |
CVE-2011-4972 | High | 7.5 | 2019-11-13 | hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private… |
CVE-2018-17960 | Medium | 6.1 | 2018-11-14 | CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. |
CVE-2018-11093 | Medium | 6.1 | 2018-05-22 | Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a craf… |
CVE-2018-9861 | Medium | 6.1 | 2018-04-19 | Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in… |
CVE-2014-5191 | | 2014-08-07 | Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unsp… | |
CVE-2014-4037 | | 2014-06-11 | Cross-site scripting (XSS) vulnerability in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor before 2.6.11 and earlier… | |
CVE-2012-2067 | | 2012-09-05 | Unspecified vulnerability in the CKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal, w… | |
CVE-2012-2066 | | 2012-09-05 | Cross-site scripting (XSS) vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1… | |
CVE-2012-4000 | | 2012-07-12 | Cross-site scripting (XSS) vulnerability in the print_textinputs_var function in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in… |