CKEditor is a widely embedded rich-text editor component integrated into content management systems, web applications, and publishing platforms across many software products, despite its narrow direct product portfolio. The vendor's vulnerability profile concentrates on input-handling and code-generation risks inherent to HTML and JavaScript processing: cross-site scripting, uncontrolled resource consumption, code injection, and exposure of sensitive information recur across its versions and variants. A moderate tendency toward public exploit availability reflects the editor's web-facing role and appeal to security researchers, though the base weakness classes are parser-oriented rather than memory-corruption driven. Defenders should treat CKEditor updates as part of their broader content-stack patching discipline and audit any exposed instances where user-supplied HTML editing is permitted; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ckeditor over time
Signals from CVEs in this vendor scope (34 CVEs).
34 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-33829MEDIUM A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code | Jun 9, 2021 | 6.1 | 32 | NO | YES |
CVE-2022-48110MEDIUM CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is | Feb 13, 2023 | 6.1 | 30 | NO | YES |
CVE-2023-31541CRITICAL A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uplo | Jun 13, 2023 | 9.8 | 29 | NO | NO |
CVE-2022-24729HIGH CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows ab | Mar 16, 2022 | 7.5 | 26 | NO | NO |
CVE-2012-4000MEDIUM Cross-site scripting (XSS) vulnerability in the print_textinputs_var function in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor 2.6.7 and | Jul 12, 2012 | 4.3 | 26 | NO | YES |
CVE-2021-26272MEDIUM It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (i | Jan 26, 2021 | 6.5 | 23 | NO | NO |
CVE-2021-26271MEDIUM It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced | Jan 26, 2021 | 6.5 | 23 | NO | NO |
CVE-2020-9281MEDIUM A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protect | Mar 7, 2020 | 6.1 | 23 | NO | NO |
CVE-2011-4972HIGH hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct re | Nov 13, 2019 | 7.5 | 23 | NO | NO |
CVE-2026-28343MEDIUM CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has | Mar 5, 2026 | 6.1 | 22 | NO | NO |
Signals from CVEs in this vendor scope (34 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ckeditor.
Media articles that mention a CVE ID that affects a product developed by Ckeditor — matched by CVE ID, not by vendor name.