# froala/wysiwyg-editor (Packagist) vulnerabilities 4 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/froala/wysiwyg-editor ## Advisories (4) ### [CVE-2024-51434](https://cve.now/CVE-2024-51434): Inconsistent \ tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier. - Severity: Medium 6.1 - Published: Nov 7, 2024 - Affected: through 4.3.0. ### [CVE-2023-41592](https://cve.now/CVE-2023-41592): Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability. - Severity: Unrated - Published: Sep 14, 2023 - Affected: from 4.0.1, fixed in 4.1.4. ### [CVE-2021-28114](https://cve.now/CVE-2021-28114): Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing. - Severity: Unrated - Published: Jul 16, 2021 - Affected: fixed in 3.2.7. ### [CVE-2020-26523](https://cve.now/CVE-2020-26523): Froala Editor before 3.2.2 allows XSS via pasted content. - Severity: Unrated - Published: Oct 2, 2020 - Affected: fixed in 3.2.2. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/froala/wysiwyg-editor Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.