Skip to content
Noroxi

Froala Editor vulnerabilitiesFroala Editor: known vulnerabilities and safe versions

npm: froala-editor

Froala Editor has 7 known vulnerability records: 5 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 2 only in Retire.js (CDN builds and advisories without a CVE).

By branch: 4.x is safe from 4.3.1; 3.x has no fixed release in the records.

Vulnerabilities and safe version by branch

Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.

BranchSupportLatest on branchRecordsSafe version
4.x——3medium4.3.1
3.x——6mediumNo fix

Support dates appear only for libraries that endoflife.date tracks.

Records

Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.

  • CVE-2024-514342024-11-07

    Inconsistent <plaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.

    Affected versions: <= 4.3.0 · < 4.3.1

    medium 6.1

    Fixed in: 4.3.1

  • CVE-2023-415922023-09-14

    Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability.

    Affected versions: >= 4.0.1, < 4.1.4

    medium 5.4

    Fixed in: 4.1.4

    EPSS 1%

  • CVE-2020-228642021-10-26

    A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor 3.1.0 allows attackers to execute arbitrary

    Affected versions: < 4.0.11

    medium 6.1

    Fixed in: 4.0.11

  • CVE-2021-281142021-07-16

    Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.

    Affected versions: < 3.2.7

    medium 5.4

    Fixed in: 3.2.7

    EPSS 52%

  • CVE-2021-30109exploit code exists2021-04-05

    Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS).

    Affected versions: <= 3.2.6 · < 3.2.7

    medium 6.1

    Fixed in: 3.2.7

    EPSS 1.2%

  • CVE-2019-199352020-07-07

    Froala Editor before 3.2.3 allows XSS.

    Affected versions: < 3.2.3

    medium 6.1

    Fixed in: 3.2.3

    EPSS 1.8%

  • no CVE

    Security issue: XSS via pasted content

    Affected versions: < 3.2.2

    medium

    Fixed in: 3.2.2

Sources and method

Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.

This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.

Data as of October 22, 2026.

Other libraries