Ckeditor

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Ckeditor product.

RSS Feeds for Ckeditor security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Ckeditor products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Ckeditor Sorted by Most Security Vulnerabilities since 2018

Ckeditor24 vulnerabilities

Ckeditor52 vulnerabilities

Ckeditor5 Markdown Gfm2 vulnerabilities

Ckeditor 51 vulnerability

Ckeditor 5 Link1 vulnerability

Ckeditor5 Engine1 vulnerability

Ckeditor5 Font1 vulnerability

Ckeditor5 Html Embed1 vulnerability

Ckeditor5 Html Support1 vulnerability

Ckeditor5 Image1 vulnerability

Ckeditor5 List1 vulnerability

Ckeditor5 Media Embed1 vulnerability

Ckeditor5 Paste From Office1 vulnerability

Ckeditor5 Widget1 vulnerability

Ckeditor Enhanced Image1 vulnerability

By the Year

In 2025 there have been 2 vulnerabilities in Ckeditor with an average score of 5.4 out of ten. Last year, in 2024 Ckeditor had 6 security vulnerabilities published. Right now, Ckeditor is on track to have less security vulnerabilities in 2025 than it did last year. Last year, the average CVE base score was greater by 0.70

Year	Vulnerabilities	Average Score
2025	2	5.40
2024	6	6.10
2023	3	7.33
2022	3	5.87
2021	10	5.91
2020	3	6.10
2019	0	0.00
2018	3	6.10

It may take a day or so for new Ckeditor vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Ckeditor Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-61261	Nov 07, 2025	CKeditor 46.1.0 Angular 18.0.0 Reflected XSS A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.	Ckeditor
CVE-2025-25299	Feb 20, 2025	CKEditor 5 XSS in RT Collaboration Markers (<=44.2.0) CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within the document. It can lead to unauthorized JavaScript code execution, which might happen with a very specific editor and token endpoint configuration. This vulnerability affects only installations with Real-time collaborative editing enabled. The problem has been recognized and patched. The fix is available in version 44.2.1 (and above). Users are advised to upgrade. There are no known workarounds for this vulnerability.	Ckeditor
CVE-2024-54407	Dec 16, 2024	CKEditor/SyntaxHighlighter <=3.4.2 CSRF + Stored XSS Cross-Site Request Forgery (CSRF) vulnerability in ???? CK and SyntaxHighlighter allows Stored XSS.This issue affects CK and SyntaxHighlighter: from n/a through 3.4.2.	Ckeditor
CVE-2024-45613	Sep 25, 2024	CKEditor5 clipboard XSS (40.0.043.1.1) with Block Toolbar plugin CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin.	Ckeditor5
CVE-2024-43411	Aug 21, 2024	CKEditor 4 v4.22+ Vulnerable To Notification Domain Control Fixed in 4.25.0-LTS CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are unsure, please contact us. The fix is available in version 4.25.0-lts.	Ckeditor
CVE-2024-43407	Aug 21, 2024	CVE-2024-43407: Reflected XSS in CKEditor4 GeSHi Plugin (Pre 4.25.0-lts) CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSHi library was included as a vendor dependency in CKEditor 4 source files. In a specific scenario, an attacker could craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP web server. The GeSHi library is no longer actively maintained. Due to the lack of ongoing support and updates, potential security vulnerabilities have been identified with its continued use. To mitigate these risks and enhance the overall security of the CKEditor 4, we have decided to completely remove the GeSHi library as a dependency. This change aims to maintain a secure environment and reduce the risk of any security incidents related to outdated or unsupported software. The fix is be available in version 4.25.0-lts.	Ckeditor
CVE-2024-24816	Feb 07, 2024	CVE-2024-24816: CKEditor4 preview XSS (<4.24.0-lts) CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.	Ckeditor
CVE-2024-24815	Feb 07, 2024	CVE-2024-24815: CKEditor4 XSS via CDATA in v<4.24.0-lts CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.	Ckeditor
CVE-2023-31541	Jun 13, 2023	A unrestricted file upload vulnerability was discovered in the Browse and upload images feature of the CKEditor v1.2.3 plugin for Redmine, which A unrestricted file upload vulnerability was discovered in the Browse and upload images feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.	Ckeditor
CVE-2023-28439	Mar 22, 2023	CKEditor4 is an open source what-you-see-is-what-you-get HTML editor CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `<textarea>` as a base; and destroying the editor instance. This vulnerability might affect a small percentage of integrators that depend on dynamic editor initialization/destroy mechanism. A fix is available in CKEditor4 version 4.21.0. In some rare cases, a security fix may be considered a breaking change. Starting from version 4.21.0, the Iframe Dialog plugin applies the `sandbox` attribute by default, which restricts JavaScript code execution in the iframe element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page.	Ckeditor
CVE-2022-48110	Feb 13, 2023	CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator (who is adding CKEditor 5 functionality to a website) to choose the correct security settings for their use case. Also, safe default values are established (e.g., config.htmlEmbed.showPreviews is false).	Ckeditor
CVE-2022-31175	Aug 03, 2022	CKEditor 5 is a JavaScript rich text editor CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an element and using an element other than `<textarea>` as a base. The root cause of the issue was a mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that depend on dynamic editor initialization/destroy and use Markdown, General HTML Support or HTML embed features. The problem has been recognized and patched. The fix is available in version 35.0.1. There are no known workarounds for this issue.	Ckeditor5 Html Support Ckeditor5 Html Embed Ckeditor5 Markdown Gfm And others...
CVE-2022-24729	Mar 16, 2022	CKEditor4 is an open source what-you-see-is-what-you-get HTML editor CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.	Ckeditor
CVE-2022-24728	Mar 16, 2022	CKEditor4 is an open source what-you-see-is-what-you-get HTML editor CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.	Ckeditor
CVE-2021-41165	Nov 17, 2021	CKEditor4 is an open source WYSIWYG HTML editor CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.	Ckeditor
CVE-2021-41164	Nov 17, 2021	CKEditor4 is an open source WYSIWYG HTML editor CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.	Ckeditor
CVE-2021-37695	Aug 13, 2021	ckeditor is an open source WYSIWYG HTML editor with rich content support ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.	Ckeditor
CVE-2021-32808	Aug 12, 2021	ckeditor is an open source WYSIWYG HTML editor with rich content support ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0. The problem has been recognized and patched. The fix will be available in version 4.16.2.	Ckeditor
CVE-2021-32809	Aug 12, 2021	ckeditor is an open source WYSIWYG HTML editor with rich content support ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.	Ckeditor
CVE-2021-33829	Jun 09, 2021	A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.	Ckeditor
CVE-2021-21391	Apr 29, 2021	CKEditor 5 provides a WYSIWYG editing solution CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal audit, a regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 packages listed above at version <= 26.0.0. The problem has been recognized and patched. The fix will be available in version 27.0.0.	Ckeditor5 Engine Ckeditor5 Font Ckeditor5 Image And others...
CVE-2021-21254	Jan 29, 2021	CKEditor 5 is an open source rich text editor framework with a modular architecture CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abuse link recognition regular expression, which could cause a significant performance drop resulting in browser tab freeze. It affects all users using CKEditor 5 Markdown plugin at version <= 24.0.0. The problem has been recognized and patched. The fix will be available in version 25.0.0.	Ckeditor 5 Ckeditor5
CVE-2021-26272	Jan 26, 2021	It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).	Ckeditor
CVE-2021-26271	Jan 26, 2021	It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin). It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).	Ckeditor
CVE-2020-27193	Nov 12, 2020	A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.	Ckeditor
CVE-2020-9440	Mar 10, 2020	A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor.	Ckeditor
CVE-2020-9281	Mar 07, 2020	A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).	Ckeditor
CVE-2018-17960	Nov 14, 2018	CKEditor 4.x before 4.11.0 CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.	Ckeditor
CVE-2018-11093	May 22, 2018	Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link (A) element.	Ckeditor 5 Link
CVE-2018-9861	Apr 19, 2018	Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.	Enhanced Image