CVE-2020-22864

CVE-2020-22864 concerns Froala WYSIWYG Editor, specifically the Insert Video function in version 3.1.0, where a cross-site scripting (XSS) vulnerability exists. The connected documents attribute the root cause to insufficient sanitization of user input in the Insert Video flow (e.g., html.insert)...

CVE-2023-41592

The CVE-2023-41592 entry concerns Froala Editor (versions 4.0.1–4.1.1) with a cross-site scripting (XSS) vulnerability. Multiple connected sources attribute the flaw to the Insert Link functionality not properly sanitizing/validating user-provided links, enabling XSS. Affected component is Froala...

CVE-2021-28114

CVE-2021-28114 affects Froala WYSIWYG Editor 3.2.6-1 with an XSS flaw caused by a namespace confusion during parsing. Red Hat, CNVD, OSV, and others report the issue and, in CNVD, an attacker could obtain an administrator cookie. The initial entry provides the vulnerability description and CVSS m...

CVE-2021-30109

Affected product: Froala Editor 3.2.6. Vulnerability: Cross-site scripting (XSS) in the hyperlink creation module. Root cause: base64 crafted strings can trigger persistent XSS under certain conditions. Impact: persistent XSS described; no specifics on affected platforms beyond Froala Editor 3.2....

CVE-2020-26523

Froala Editor prior to 3.2.2 is vulnerable to XSS via pasted content . Affected: Froala Editor (WYSIWYG) before 3.2.2; root cause: improper handling of pasted HTML. Impact: cross-site scripting (CVSSv3.1 base score 6.1; vector Nv: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation details are not...

CVE-2023-42426

CVE-2023-42426 is an XSS vulnerability in Froala Editor v4.1.1. A remote attacker can inject arbitrary code via the Insert link parameter in the Insert Image component, with a CVSS v3.1 base score of 6.1 (Medium). Exploitation details are not provided in the supplied documents. Remediation in the...

CVE-2019-19935

Froala Editor prior to 3.2.3 is vulnerable to DOM-based XSS due to improper sanitization when HTML is inserted into the DOM. Affected versions include 3.2.2 and earlier; exploitation can occur via editor content manipulation (e.g., switching to code view). Remediation: upgrade to 3.2.3 or later w...

CVE-2023-43263

CVE-2023-43263 concerns Froala Editor v4.1.1 with a Cross-site Scripting (XSS) issue via the Markdown component. The vulnerability allows an attacker to cause arbitrary code execution through the Markdown feature, as described in multiple sources (NVD, Red Hat, OSV, and related advisories). Mitig...