What’s Vulnerable › Products

ckeditor5 vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your ckeditor5 version is affected

Latest ckeditor5 vulnerabilities

• CVE-2026-116688 — CKEditor: Cross-site scripting (XSS) in the engine package (CVSS 8.1)
• CVE-2026-116687 — CKEditor: Cross-site scripting (XSS) in the engine package (CVSS 3.1)
• CVE-2026-28343 — CKEditor: Cross-site scripting (XSS) in the HTML Support package (CVSS 6.1)
• CVE-2025-61261 — (CVSS 5.4)
• CVE-2025-58064 — CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package (CVSS 2.3)
• CVE-2025-25299 — Cross-site scripting (XSS) in the real-time collaboration package (CVSS 2.3)
• CVE-2024-45613 — CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package (CVSS 6.1)
• CVE-2021-21254 — Regular expression Denial of Service in Markdown plugin (CVSS 6.5)