CKEditor 4 vulnerabilitiesCKEditor 4: known vulnerabilities and safe versions
npm: ckeditor4
CKEditor 4 has 26 known vulnerability records: 16 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 10 only in Retire.js (CDN builds and advisories without a CVE). The latest release is 49.0.0 (endoflife.date).
By branch: 5.x has no known records; 4.x is safe from 4.25.0.
Vulnerabilities and safe version by branch
Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.
| Branch | Support | Latest on branch | Records | Safe version |
|---|---|---|---|---|
| 5.x | Supported | 49.0.0 | 0 | — |
| 4.x | Ended (June 30, 2023) | 4.25.2 | 26high | 4.25.0 |
Records
Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.
CVE-2024-434112024-08-21
CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover
Affected versions: >= 4.22.0, < 4.25.0
low 3.1
Fixed in: 4.25.0
CVE-2024-434072024-08-21
Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability
Affected versions: < 4.25.0
medium 6.1
Fixed in: 4.25.0
CVE-2024-24816exploit code exists2024-02-07
Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature
Affected versions: < 4.24.0-lts
medium 6.1
Fixed in: 4.24.0-lts
EPSS 1.6%
CVE-2024-248152024-02-07
CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection
Affected versions: < 4.24.0-lts
medium 6.1
Fixed in: 4.24.0-lts
CVE-2023-47712023-11-16
Cross-Site Scripting vulnerability in CKSource CKEditor
Affected versions: < 4.24.0-lts
medium 6.1
Fixed in: 4.24.0-lts
CVE-2023-284392023-03-22
ckeditor4 plugins vulnerable to cross-site scripting caused by the editor instance destroying process
Affected versions: < 4.21.0
medium 6.1
Fixed in: 4.21.0
CVE-2022-247292022-03-16
Regular expression Denial of Service in dialog plugin
Affected versions: < 4.18.0
high 7.5
Fixed in: 4.18.0
EPSS 2.4%
medium 5.4
Fixed in: 4.18.0
EPSS 1.2%
CVE-2021-411652021-11-17
HTML comments vulnerability allowing to execute JavaScript code
Affected versions: < 4.17.0
medium 5.4
Fixed in: 4.17.0
EPSS 1.5%
CVE-2021-411642021-11-17
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
Affected versions: < 4.17.0
medium 5.4
Fixed in: 4.17.0
EPSS 1.3%
CVE-2021-376952021-08-12
Execution of JavaScript code using malformed HTML in ckeditor
Affected versions: < 4.16.2
medium 5.4
Fixed in: 4.16.2
EPSS 1.3%
CVE-2021-328092021-08-12
Arbitrary HTML injection vulnerability in ckeditor
Affected versions: >= 4.5.2, < 4.16.2 · < 4.16.2
medium 5.4
Fixed in: 4.16.2
EPSS 1.1%
CVE-2021-328082021-08-12
Cross-site scripting in ckeditor via abuse of undo functionality
Affected versions: >= 4.13.0, < 4.16.2 · < 4.16.2
medium 5.4
Fixed in: 4.16.2
EPSS 1.1%
CVE-2021-33829exploit code exists2021-06-09
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attack
Affected versions: >= 4.14.0, < 4.16.1
medium 6.1
Fixed in: 4.16.1
EPSS 3.1%
CVE-2021-262722021-01-26
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the
Affected versions: < 4.16.0
medium 6.5
Fixed in: 4.16.0
EPSS 2.3%
CVE-2020-271932020-11-12
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web scrip
Affected versions: < 4.15.1
medium 6.1
Fixed in: 4.15.1
EPSS 2%
CVE-2020-92812020-03-06
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitra
Affected versions: < 4.14.0
medium 6.1
Fixed in: 4.14.0
EPSS 4.3%
CVE-2018-179602018-11-14
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
Affected versions: >= 4.0.0, < 4.11.0
medium 6.1
Fixed in: 4.11.0
EPSS 1.9%
no CVE
XSS if the enhanced image plugin is installed
Affected versions: >= 4.5.11, < 4.9.2
medium
Fixed in: 4.9.2
no CVE
XSS
Affected versions: < 4.5.11
medium
Fixed in: 4.5.11
no CVE
XSS
Affected versions: < 4.4.8
medium
Fixed in: 4.4.8
no CVE
XSS
Affected versions: < 4.4.6
medium
Fixed in: 4.4.6
no CVE
XSS
Affected versions: < 4.4.3
medium
Fixed in: 4.4.3
no CVE
ReDoS vulnerability in Autolink plugin and Advanced Tab for Dialogs plugin
Affected versions: < 4.16.0
low
Fixed in: 4.16.0
no CVE
XSS-type attack inside CKEditor 4 by persuading a victim to paste a specially crafted HTML code into the Color Button dialog
Affected versions: < 4.15.1
medium
Fixed in: 4.15.1
no CVE
XSS
Affected versions: < 4.14.0
low
Fixed in: 4.14.0
Sources and method
Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.
This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.
Data as of October 22, 2026.