Skip to main content
cve.nowby Sazabi
← npm
npmPackage

ckeditor4

16 known vulnerabilities (4 high, 7 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
16 · 4 high, 7 medium, 1 low
Registry
npm

Advisories 16

  • CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover

    Affected: from 4.22.0, fixed in 4.25.0.

  • CVE-2024-43407Medium 6.1

    Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability

    Affected: fixed in 4.25.0.

  • CVE-2024-24816Medium 6.1

    Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature

    Affected: fixed in 4.24.0-lts.

  • CVE-2024-24815Medium 6.1

    CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection

    Affected: fixed in 4.24.0-lts.

  • CVE-2023-4771Medium 6.1

    Cross-Site Scripting vulnerability in CKSource CKEditor

    Affected: fixed in 4.24.0-lts.

  • CVE-2022-24729Medium 6.5

    Regular expression Denial of Service in dialog plugin

    Affected: fixed in 4.18.0.

  • CVE-2022-24728Medium 5.4

    Cross-site Scripting in CKEditor4

    Affected: fixed in 4.18.0.

  • HTML comments vulnerability allowing to execute JavaScript code

    Affected: fixed in 4.17.0.

  • Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML

    Affected: fixed in 4.17.0.

  • Execution of JavaScript code using malformed HTML in ckeditor

    Affected: fixed in 4.16.2.

  • CVE-2021-32809Medium 4.6

    Arbitrary HTML injection vulnerability in ckeditor

    Affected: from 4.5.2, fixed in 4.16.2.

  • Cross-site scripting in ckeditor via abuse of undo functionality

    Affected: from 4.13.0, fixed in 4.16.2.

  • A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote…

    Affected: from 4.14.0, fixed in 4.16.1.

  • It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into…

    Affected: fixed in 4.16.0.

  • A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web…

    Affected: fixed in 4.15.1.

  • A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject…

    Affected: fixed in 4.14.0.