Description
All versions of wangeditor are vulnerable to Cross-Site Scripting. The package fails to properly encode output, allowing arbitrary JavaScript to be inserted in links and executed by browsers.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 0
References
Could your website be exposed too?
SmartScanner can check your website for Cross-Site Scripting in wangeditor and gives you actionable findings to investigate.
Start a free scanRelated Issues
- wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function - CVE-2022-25037
- TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - CVE-2026-47760
- CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection - CVE-2024-24815
- RSSHub Cross-site Scripting vulnerability caused by internal media proxy - CVE-2024-27926
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023