Vulnerability advisory

GHSA-v27h-j97p-wqmx

The Preview plugin in CKEditor allows Cross-site scripting (XSS)

Published May 17, 2022Updated Feb 19, 2025OSV record ↗

Also known as CVE-2014-5191

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected versions

ckeditor/ckeditor Packagist

All ckeditor/ckeditor advisories →

Affected	Fixed in
All versions before 4.4.3	`4.4.3`Advisories →
Also listed as affected (6) `4.3.3` `4.3.4` `4.3.5` `4.4.0` `4.4.1` `4.4.2`

Description

Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2014-5191 ↗
Webgithub.com/ckeditor/ckeditor4/commit/b685874c6bc873a76e6e95916c43840a2b7ab08a ↗
Packagegithub.com/ckeditor/ckeditor4-releases ↗
Webckeditor.com/node/136981 ↗