CKEditor 45.x < 47.7.4 / 48.x < 48.5.1 XSS

The version of CKEditor included on the remote web host is 45.x prior to 47.7.4, or 48.x prior to 48.5.1. It is, therefore, affected by a cross-site scripting XSS vulnerability. The CKEditor 5 engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while...

CKEditor: Cross-site Scripting (XSS) In The Engine Package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the "es-toolkit" library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the...

CKEditor: Cross-site scripting (XSS) in the engine package

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the...

UBUNTU-CVE-2026-116688

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

CVE-2026-116688

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

CVE-2026-116688 CKEditor: Cross-site scripting (XSS) in the engine package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

CVE-2026-116688

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

CVE-2026-116688

CKEditor 5, a JavaScript rich-text editor, is vulnerable to Cross-site scripting (XSS) in its engine package. The issue exists in versions 45.0.0 through 47.7.4 and 48.5.1 because the engine utilizes a vulnerable es-toolkit version. Attackers can trigger prototype-pollution behavior by providing ...

CVE-2026-116688 CKEditor: Cross-site scripting (XSS) in the engine package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

CVE-2026-116688 CKEditor: Cross-site scripting (XSS) in the engine package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

EUVD-2026-111364

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

CVE-2026-116688: Improper Neutralization of Input During Web Page Generation

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can...

CKEditor Ecosystem CKEditor 5 Cross-site Scripting Vulnerability

The CKEditor ecosystem contains a cross-site scripting vulnerability in versions 45.0.0 through 47.7.4 and 48.0.0 through 48.5.1 of CKEditor 5. This vulnerability stems from prototype pollution issues related to the es-toolkit version used by the engine; when processing incoming values for the...

PT-2026-127753

Impact A Cross-Site Scripting XSS vulnerability has been discovered in the CKEditor 5 engine. This vulnerability is caused by a prototype pollution issue in the es-toolkit library used in the CKEditor 5 codebase. This vulnerability could lead to unauthorized JavaScript code execution when the...

PT-2026-127221

Name of the Vulnerable Software and Affected Versions CKEditor 5 versions 45.0.0 through 47.7.3 CKEditor 5 versions 48.0.0 through 48.5.0 Description A prototype pollution issue exists in the es-toolkit library used by the engine. This occurs when the editor processes incoming style attribute...

UBUNTU-CVE-2026-115351

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url to the rendered figure...

CVE-2026-113493

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any...

PT-2026-122506

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any...

npm: odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

npm: odf-kit has HTML injection leading to XSS in odsToHtml via unescaped style attribute values vulnerability discovered by ? in WordPress npm odf-kit versions = 0.9.8, 0.14.2...

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

Summary ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer odsToHtml. A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore scri...