What’s Vulnerable › Vulnerabilities

CVE-2025-61261

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-07 · updated 2026-06-17
• Weakness: CWE-79

Description

A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.

Affected products

• angular: 18.0.0
• ckeditor5: 46.1.0

References

• https://github.com/ckeditor/ckeditor5/releases/tag/v46.1.0
• https://senscybersecurity.nl/cve-2025-61261-explained/

Get alerted when CVE-2025-61261 or the next vulnerability affects your stack