Description
The Enhanced Image (aka image2) plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, and as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, is vulnerable to cross-site scripting because it allows remote attackers to inject arbitrary web script through a crafted IMG element.
Recommendation
Update the ckeditor-dev package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.5.10, < 4.9.2
- Patched version(s): 4.9.2
References
Could your website be exposed too?
SmartScanner can check your website for Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor - CVE-2023-37905
- Bootstrap vulnerable to Cross-Site Scripting (XSS) - CVE-2018-14040
- Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability - CVE-2024-43407
- CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - @ckeditor/ckeditor5-html-support - CVE-2026-28343
You might also like:
See something that needs correcting? Let us knowUpdated February 05, 2024