ckeditor5
- Software type
- Web framework
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/07/2026, ckeditor5 recorded 2 security vulnerabilities in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of ckeditor5 and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-116688CKEditor: Cross-site scripting (XSS) in the engine packageCVE-2026-116687CKEditor: Cross-site scripting (XSS) in the engine packageCVE-2026-28343CKEditor: Cross-site scripting (XSS) in the HTML Support packageCVE-2025-61261Reflected XSS in CKEditor and Angular enables browser-side code executionCVE-2025-58064CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-116688CKEditor: Cross-site scripting (XSS) in the engine package | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-116687CKEditor: Cross-site scripting (XSS) in the engine package | Exploitation statusNot confirmed | FixYes | Published10/27/2026 | SeverityLow |
|---|
CVE-2026-28343CKEditor: Cross-site scripting (XSS) in the HTML Support package | Exploitation statusNot exploited | FixYes | Published03/05/2026 | SeverityMedium |
|---|
CVE-2025-61261Reflected XSS in CKEditor and Angular enables browser-side code execution | Exploitation statusActively exploited | FixNo | Published11/07/2025 | SeverityMedium |
|---|
CVE-2025-58064CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package | Exploitation statusNot exploited | FixYes | Published09/03/2025 | SeverityLow |
|---|
CVE-2025-25299Cross-site scripting (XSS) in the real-time collaboration package | Exploitation statusNot exploited | FixYes | Published02/20/2025 | SeverityLow |
|---|
CVE-2024-45613CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package | Exploitation statusNot exploited | FixNo | Published09/25/2024 | SeverityMedium |
|---|
CVE-2022-31175Cross-site scripting caused by the editor instance destroying process in ckeditor5 | Exploitation statusNot exploited | FixYes | Published08/03/2022 | SeverityMedium |
|---|
CVE-2021-21391Regular expression Denial of Service in multiple packages | Exploitation statusNot confirmed | FixNo | Published04/29/2021 | SeverityMedium |
|---|
CVE-2021-21254Regular expression Denial of Service in Markdown plugin | Exploitation statusNot confirmed | FixNo | Published01/29/2021 | SeverityMedium |
|---|
10 Results | Page 1 of 1