CVE-2025-6674 CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting XSS.This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3...

CVE-2025-6674

The Drupal CKEditor5 Youtube video integration plugin is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The root cause is that the module fails to sufficiently validate iframe sources when a user embeds a video. This issue affects vers...