ckeditor ckeditor4
12 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-43411 | >= 4.22.0, < 4.25.0-lts | CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover | LOW 3.1 | 0.4 % | ||
| CVE-2024-43407 | < 4.25.0-lts | Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-24816 | < 4.24.0-lts | Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature | MEDIUM 6.1 | 1.7 % | ||
| CVE-2024-24815 | < 4.24.0-lts | CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection | MEDIUM 6.1 | 0.7 % | ||
| CVE-2023-28439 | < 4.21.0 | ckeditor4 plugins vulnerable to cross-site scripting caused by the editor instance destroying process | MEDIUM 6.1 | 0.7 % | ||
| CVE-2022-24729 | < 4.18.0 | Regular expression Denial of Service in dialog plugin | HIGH 7.5 | 2.5 % | ||
| CVE-2022-24728 | < 4.18.0 | Cross-site Scripting in CKEditor4 | MEDIUM 5.4 | 1.2 % | ||
| CVE-2021-41165 | < 4.17.0 | HTML comments vulnerability allowing to execute JavaScript code | HIGH 8.2 | 1.6 % | ||
| CVE-2021-41164 | < 4.17.0 | Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML | HIGH 8.2 | 1.3 % | ||
| CVE-2021-37695 | < 4.16.2 | Execution of JavaScript code using malformed HTML in ckeditor | HIGH 7.3 | 1.3 % | ||
| CVE-2021-32809 | >= 4.5.2, < 4.16.2 | Arbitrary HTML injection vulnerability in ckeditor | MEDIUM 5.4 | 1.2 % | ||
| CVE-2021-32808 | >= 4.13.0, < 4.16.2 | Cross-site scripting in ckeditor via abuse of undo functionality | HIGH 7.6 | 1.2 % |