ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor

Description

It has been discovered that the ckeditor-wordcount-plugin plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode.

Recommendation

Update the ckeditor-wordcount-plugin package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.17.11
• Patched version(s): 1.17.12

References

• GHSA-q9w4-w667-qqj4
• typo3.org
• CVE-2023-37905
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Jodit Editor vulnerable to cross-site scripting - CVE-2023-42399
• editor.md vulnerable to Cross-site Scripting - CVE-2023-29641
• Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS) - CVE-2018-9861
• Froala Editor Cross-site Scripting vulnerability - CVE-2023-41592

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

ckeditor-wordcount-plugin