ckeditor
- Total products in the ecosystem
- 3
- Total vulnerabilities (90 days)
- 2
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, ckeditor recorded 2 security vulnerabilities in the last 90 days across 1 products, including 1 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, ckeditor5 had the most security vulnerabilities in the ckeditor ecosystem, with 2 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-116688CKEditor: Cross-site scripting (XSS) in the engine packageCVE-2026-116687CKEditor: Cross-site scripting (XSS) in the engine packageCVE-2026-28343CKEditor: Cross-site scripting (XSS) in the HTML Support packageCVE-2025-61261Reflected XSS in CKEditor and Angular enables browser-side code executionCVE-2025-58064CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-116688CKEditor: Cross-site scripting (XSS) in the engine package | Exploitation statusNot exploited | FixYes |
| Published10/27/2026 |
| SeverityHigh |
CVE-2026-116687CKEditor: Cross-site scripting (XSS) in the engine package | Exploitation statusNot confirmed | FixYes | Affected productckeditor5 | Published10/27/2026 | SeverityLow |
|---|
CVE-2026-28343CKEditor: Cross-site scripting (XSS) in the HTML Support package | Exploitation statusNot exploited | FixYes | Affected productckeditor5 | Published03/05/2026 | SeverityMedium |
|---|
CVE-2025-61261Reflected XSS in CKEditor and Angular enables browser-side code execution | Exploitation statusActively exploited | FixNo | Affected productangular | Published11/07/2025 | SeverityMedium |
|---|
CVE-2025-58064CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package | Exploitation statusNot exploited | FixYes | Affected productckeditor5 | Published09/03/2025 | SeverityLow |
|---|
CVE-2025-25299Cross-site scripting (XSS) in the real-time collaboration package | Exploitation statusNot exploited | FixYes | Affected productckeditor5 | Published02/20/2025 | SeverityLow |
|---|
CVE-2024-45613CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package | Exploitation statusNot exploited | FixNo | Affected productckeditor5 | Published09/25/2024 | SeverityMedium |
|---|
CVE-2024-43411CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover | Exploitation statusNot exploited | FixYes | Affected productckeditor4 | Published08/21/2024 | SeverityLow |
|---|
CVE-2024-43407Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability | Exploitation statusNot exploited | FixNo | Affected productckeditor4 | Published08/21/2024 | SeverityMedium |
|---|
CVE-2024-24816Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature | Exploitation statusNot exploited | FixYes | Affected productckeditor4 | Published02/07/2024 | SeverityMedium |
|---|
CVE-2024-24815CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection | Exploitation statusNot exploited | FixYes | Affected productckeditor4 | Published02/07/2024 | SeverityMedium |
|---|
CVE-2023-31541Unrestricted file upload in CKEditor plugin for Redmine can enable server-side code execution | Exploitation statusActively exploited | FixNo | Affected productckeditor | Published06/13/2023 | SeverityCritical |
|---|
CVE-2023-28439ckeditor4 plugins vulnerable to cross-site scripting caused by the editor instance destroying process | Exploitation statusNot exploited | FixYes | Affected productckeditor4 | Published03/22/2023 | SeverityMedium |
|---|
CVE-2022-31175Cross-site scripting caused by the editor instance destroying process in ckeditor5 | Exploitation statusNot exploited | FixYes | Affected productckeditor5 | Published08/03/2022 | SeverityMedium |
|---|
CVE-2022-24729Regular expression Denial of Service in dialog plugin | Exploitation statusNot exploited | FixYes | Affected productckeditor4 | Published03/16/2022 | SeverityMedium |
|---|
CVE-2022-24728Cross-site Scripting in CKEditor4 | Exploitation statusNot exploited | FixYes | Affected productckeditor4 | Published03/16/2022 | SeverityMedium |
|---|
CVE-2021-41165HTML comments vulnerability allowing to execute JavaScript code | Exploitation statusNot confirmed | FixNo | Affected productckeditor4 | Published11/17/2021 | SeverityHigh |
|---|
CVE-2021-41164Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML | Exploitation statusNot confirmed | FixNo | Affected productckeditor4 | Published11/17/2021 | SeverityHigh |
|---|
CVE-2021-37695Execution of JavaScript code using malformed HTML in ckeditor | Exploitation statusNot confirmed | FixNo | Affected productckeditor4 | Published08/12/2021 | SeverityHigh |
|---|
CVE-2021-32809Arbitrary HTML injection vulnerability in ckeditor | Exploitation statusNot confirmed | FixNo | Affected productckeditor4 | Published08/12/2021 | SeverityMedium |
|---|
CVE-2021-32808Cross-site scripting in ckeditor via abuse of undo functionality | Exploitation statusNot confirmed | FixNo | Affected productckeditor4 | Published08/12/2021 | SeverityHigh |
|---|
CVE-2021-21391Regular expression Denial of Service in multiple packages | Exploitation statusNot confirmed | FixNo | Affected productckeditor5 | Published04/29/2021 | SeverityMedium |
|---|
CVE-2021-21254Regular expression Denial of Service in Markdown plugin | Exploitation statusNot confirmed | FixNo | Affected productckeditor5 | Published01/29/2021 | SeverityMedium |
|---|
23 Results | Page 1 of 1