Description
Inconsistent<![CDATA[tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.</plaintext></p><h2 id="recommendation">Recommendation</h2><p>No fix is available yet. Followings are affected versions:</p><ul><li><strong><= 4.3.0</strong></li></ul><h2 id="references">References</h2><ul><li><a href="https://github.com/advisories/GHSA-549p-5c7f-c5p4" target="_blank" rel="noopener noreferrer">GHSA-549p-5c7f-c5p4</a></li><li><a href="https://georgyg.com/home/froala-wysiwyg-editor---xss-cve-2024-51434" target="_blank" rel="noopener noreferrer">georgyg.com</a></li><li><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-51434" target="_blank" rel="noopener noreferrer">CVE-2024-51434</a></li><li><a href="https://cwe.mitre.org/data/definitions/79.html" target="_blank" rel="noopener noreferrer">CWE-79</a></li><li><a href="https://capec.mitre.org/data/definitions/C-310.html" target="_blank" rel="noopener noreferrer">CAPEC-310</a></li><li><a href="https://owasp.org/Top10/A03_2021-Injection/" target="_blank" rel="noopener noreferrer">OWASP 2021-A3</a></li><li><a href="https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/" target="_blank" rel="noopener noreferrer">OWASP 2021-A6</a></li></ul></div><div class="mt-10 mb-8 rounded-2xl border border-emerald-200 bg-emerald-50 p-6 lg:p-8"><h2 class="mt-0 mb-2 text-2xl">Could your website be exposed too?</h2><p class="mb-5 max-w-2xl text-base text-slate-700">SmartScanner can check your website for <i>Froala WYSIWYG editor allows cross-site scripting (XSS)</i> and gives you actionable findings to investigate.</p><a href="#scan" class="inline-flex items-center rounded-lg bg-brand px-5 py-3 font-bold text-white no-underline transition hover:-translate-y-px hover:bg-brand-800 hover:text-white">Start a free scan <span class="ml-2" aria-hidden="true">→</span></a></div><h2>Related Issues</h2><ul><li><a href="/vulnerability-list/cross-site-scripting-in-froala-editor-froala-editor">Cross-site Scripting in Froala Editor - froala-editor - CVE-2021-30109</a></li><li><a href="/vulnerability-list/froala-editor-cross-site-scripting-vulnerability">Froala Editor Cross-site Scripting vulnerability - CVE-2023-41592</a></li><li><a href="/vulnerability-list/cross-site-scripting-in-froala-editor">Cross site scripting in froala-editor - CVE-2020-22864</a></li><li><a href="/vulnerability-list/dom-based-cross-site-scripting-in-froala-editor">DOM-based cross-site scripting in Froala Editor - CVE-2019-19935</a></li></ul><div class="mt-14 lg:mt-[88px]"><h3 class="text-base font-semibold mb-9 mx-auto w-fit">You might also like:</h3><div class="flex flex-wrap lg:flex-nowrap justify-between gap-[22px]"><div class="rounded-lg p-4 border lg:max-w-[252px] b-neutral-300 flex-grow"><div class="relative overflow-hidden mb-2"><div class="flex items-center justify-center w-full lg:w-[213px] min-w-[213px] min-h-[142px] h-[142px] bg-cover bg-center relative hover:scale-125 transition-all duration-200" style="background-image: url(/assets/img/express-security.png);"><a href="/blog/how-to-secure-your-nodejs-express-javascript-application-part-1" class="resetLink flex w-full h-full" aria-label="Read the full article: How to Secure your NodeJs Express Javascript Application - part 1"><img class="invisible" width="213" height="142" src="/assets/img/express-security.png" alt="How to Secure your NodeJs Express Javascript Application - part 1" aria-hidden="true" loading="lazy"></a></div></div><h3 class="text-base font-normal m-0 hover:text-emerald-750"><a class="resetLink" href="/blog/how-to-secure-your-nodejs-express-javascript-application-part-1">How to Secure your NodeJs Express Javascript Application - part 1</a></h3></div><div class="rounded-lg p-4 border lg:max-w-[252px] b-neutral-300 flex-grow"><div class="relative overflow-hidden mb-2"><div class="flex items-center justify-center w-full lg:w-[213px] min-w-[213px] min-h-[142px] h-[142px] bg-cover bg-center relative hover:scale-125 transition-all duration-200" style="background-image: url(/assets/img/how-hackers-hack.png);"><a href="/blog/how-do-hackers-hack" class="resetLink flex w-full h-full" aria-label="Read the full article: How do hackers hack websites?"><img class="invisible" width="213" height="142" src="/assets/img/how-hackers-hack.png" alt="How do hackers hack websites?" aria-hidden="true" loading="lazy"></a></div></div><h3 class="text-base font-normal m-0 hover:text-emerald-750"><a class="resetLink" href="/blog/how-do-hackers-hack">How do hackers hack websites?</a></h3></div><div class="rounded-lg p-4 border lg:max-w-[252px] b-neutral-300 flex-grow"><div class="relative overflow-hidden mb-2"><div class="flex items-center justify-center w-full lg:w-[213px] min-w-[213px] min-h-[142px] h-[142px] bg-cover bg-center relative hover:scale-125 transition-all duration-200" style="background-image: url(/assets/img/security-acronym-cheat-sheet-small.png);"><a href="/blog/csrf-xxe-and-12-other-security-acronyms-explained" class="resetLink flex w-full h-full" aria-label="Read the full article: CSRF, XXE, and 12 Other Security Acronyms Explained"><img class="invisible" width="213" height="142" src="/assets/img/security-acronym-cheat-sheet-small.png" alt="CSRF, XXE, and 12 Other Security Acronyms Explained" aria-hidden="true" loading="lazy"></a></div></div><h3 class="text-base font-normal m-0 hover:text-emerald-750"><a class="resetLink" href="/blog/csrf-xxe-and-12-other-security-acronyms-explained">CSRF, XXE, and 12 Other Security Acronyms Explained</a></h3></div></div></div><div class="mt-10 flex flex-wrap justify-between gap-2 border-t border-slate-200 pt-5 text-sm text-slate-500"><span>See something that needs correcting? <a class="resetLink underline hover:text-emerald-750" href="/contact">Let us know</a></span><span>Updated March 14, 2025</span></div></article><aside class="h-fit lg:sticky lg:top-8"><div class="rounded-2xl border border-slate-200 bg-white p-6 shadow-sm"><h3 class="mb-5 text-lg">At a glance</h3><dl class="divide-y divide-slate-100 text-sm"><div class="flex items-center justify-between gap-4 py-3 first:pt-0"><dt class="text-slate-500">Severity</dt><dd><a href="/vulnerability-list/#q=&severity=Medium&tags=" class="resetLink rounded-full border px-3 py-1 font-semibold bg-orange-100 text-orange-800 border-orange-200">Medium</a></dd></div><div class="flex items-start justify-between gap-4 py-3"><dt class="text-slate-500">Updated</dt><dd class="text-right font-semibold text-slate-800">Mar 14, 2025</dd></div><div class="py-3"><dt class="mb-2 text-slate-500">Tags</dt><dd class="flex flex-wrap gap-2"><a href="/vulnerability-list/#q=&severity=&tags=npm" class="resetLink rounded bg-slate-100 px-2 py-1 text-xs font-medium text-slate-700 hover:bg-slate-200">npm</a><a href="/vulnerability-list/#q=&severity=&tags=froala-editor" class="resetLink rounded bg-slate-100 px-2 py-1 text-xs font-medium text-slate-700 hover:bg-slate-200">froala-editor</a></dd></div></dl></div><div class="mt-6 rounded-2xl border border-slate-200 bg-white p-6 shadow-sm"><h3 class="mb-3 text-lg">Standards and IDs</h3><div class="flex flex-wrap gap-2"><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">OWASP 2021-A6</span><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">OWASP 2021-A3</span><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">OWASP 2017-A9</span><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">OWASP 2017-A1</span><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">OWASP 2013-A9</span><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">OWASP 2013-A1</span><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">OWASP 2010-A6</span><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">OWASP 2010-A1</span><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">OWASP 2007-A2</span><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">GHSA-549p-5c7f-c5p4</span><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">CWE-79</span><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N</span><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">CVE-2024-51434</span><span class="rounded bg-slate-100 px-2 py-1 text-xs text-slate-600">CAPEC-310</span></div></div></aside></div></section></main><script type="application/ld+json">[
{
"@context": "https://schema.org",
"@type": "BreadcrumbList",
"itemListElement": [
{
"@type": "ListItem",
"position": 1,
"name": "Security Vulnerabilities",
"item": "https://www.thesmartscanner.com/vulnerability-list/"
},
{
"@type": "ListItem",
"position": 2,
"name": "Froala WYSIWYG editor allows cross-site scripting (XSS) - CVE-2024-51434"
}
]
},
{
"@context": "https://schema.org",
"@type": "TechArticle",
"headline": "Froala WYSIWYG editor allows cross-site scripting (XSS) - CVE-2024-51434",
"description": "DescriptionInconsistent tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.",
"datePublished": "2025-03-14T18:51:50+00:00",
"dateModified": "2025-03-14T18:51:50+00:00",
"author": {
"@type": "Organization",
"name": "SmartScanner"
},
"publisher": {
"@type": "Organization",
"name": "SmartScanner",
"logo": {
"@type": "ImageObject",
"url": "https://www.thesmartscanner.com/assets/img/logo.png"
}
},
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://www.thesmartscanner.com/vulnerability-list/froala-wysiwyg-editor-allows-cross-site-scripting-xss"
}
}
]</script><footer class="bg-slate-950 text-slate-300"><div class="mx-auto max-w-6xl px-4 py-12 xl:px-0 lg:py-16"><div class="grid gap-10 lg:grid-cols-[minmax(0,1.35fr)_repeat(4,minmax(0,1fr))] lg:gap-8"><div class="max-w-xs"><a href="/" class="resetLink inline-flex items-center gap-3 text-lg font-bold text-white no-underline"><img src="/assets/img/logo.svg" width="36" height="36" alt="SmartScanner logo" class="h-9 w-9"> SmartScanner</a><p class="mt-5 text-sm leading-6 text-slate-400">AI-powered web application security testing for developers, security teams, pentesters, and businesses.</p><nav class="mt-5" aria-label="Support navigation"><ul class="flex flex-wrap gap-x-5 gap-y-2 text-sm list-none"><li><a href="/contact" class="resetLink hover:text-emerald-300">Contact Us</a></li><li><a href="/support#faq" class="resetLink hover:text-emerald-300">FAQ</a></li><li><a href="/support" class="resetLink hover:text-emerald-300">Support</a></li></ul></nav><div class="mt-6 flex items-center gap-3"><a href="https://twitter.com/TheSmartScanner" class="grid h-9 w-9 place-items-center rounded-lg border border-white/10 text-slate-300 transition hover:border-emerald-400/50 hover:bg-emerald-400/10 hover:text-emerald-300" aria-label="SmartScanner on X"><svg viewBox="0 0 24 24" class="h-4 w-4" fill="currentColor" aria-hidden="true"><path d="M18.9 2H22l-6.77 7.74L23.2 22h-6.24l-4.89-6.39L6.48 22H3.36l7.24-8.28L2.2 2h6.4l4.42 5.84L18.9 2Zm-1.1 17.9h1.73L7.53 4.03H5.67L17.8 19.9Z"/></svg></a><a href="mailto:support@thesmartscanner.com" class="grid h-9 w-9 place-items-center rounded-lg border border-white/10 text-slate-300 transition hover:border-emerald-400/50 hover:bg-emerald-400/10 hover:text-emerald-300" aria-label="Email SmartScanner support"><svg viewBox="0 0 24 24" class="h-4 w-4" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true"><rect x="3" y="5" width="18" height="14" rx="2"/><path d="m4 7 8 6 8-6"/></svg></a></div></div><nav aria-label="Product navigation"><h2 class="mb-4 text-sm font-bold uppercase tracking-[0.12em] text-white">Product</h2><ul class="space-y-3 text-sm list-none"><li><a href="/features" class="resetLink hover:text-emerald-300">Why SmartScanner?</a></li><li><a href="/download" class="resetLink hover:text-emerald-300">Download</a></li><li><a href="/pricing" class="resetLink hover:text-emerald-300">Plans and pricing</a></li><li><a href="/changelog" class="resetLink hover:text-emerald-300">Product updates</a></li></ul></nav><nav aria-label="Security solutions navigation"><h2 class="mb-4 text-sm font-bold uppercase tracking-[0.12em] text-white">Solutions</h2><ul class="space-y-3 text-sm list-none"><li><a href="/free-website-vulnerability-scanner/" class="resetLink hover:text-emerald-300">Free website scanner</a></li><li><a href="/vulnerability-scanner/" class="resetLink hover:text-emerald-300">Web vulnerability scanner</a></li><li><a href="/owasp-top-10-scanner/" class="resetLink hover:text-emerald-300">OWASP Top 10 scanner</a></li><li><a href="/api-security-scanner/" class="resetLink hover:text-emerald-300">API security scanner</a></li><li><a href="/pentest-automation-tool/" class="resetLink hover:text-emerald-300">Pentest automation</a></li></ul></nav><nav aria-label="Resources navigation"><h2 class="mb-4 text-sm font-bold uppercase tracking-[0.12em] text-white">Resources</h2><ul class="space-y-3 text-sm list-none"><li><a href="/vulnerability-list/" class="resetLink hover:text-emerald-300">Vulnerability library</a></li><li><a href="/docs/" class="resetLink hover:text-emerald-300">Documentation</a></li><li><a href="/blog/" class="resetLink hover:text-emerald-300">Security blog</a></li><li><a href="/tools/robotstxt/" class="resetLink hover:text-emerald-300">Robots.txt validator</a></li><li><a href="/air-gapped-security/" class="resetLink hover:text-emerald-300">Air-gapped security</a></li></ul></nav><nav aria-label="Alternatives navigation"><h2 class="mb-4 text-sm font-bold uppercase tracking-[0.12em] text-white">Alternatives</h2><ul class="space-y-3 text-sm list-none"><li><a href="/alternatives/" class="resetLink hover:text-emerald-300">All alternatives</a></li><li><a href="/acunetix-alternative" class="resetLink hover:text-emerald-300">Acunetix</a></li><li><a href="/burp-suite-alternative" class="resetLink hover:text-emerald-300">Burp Suite</a></li><li><a href="/netsparker-alternative" class="resetLink hover:text-emerald-300">Netsparker</a></li><li><a href="/nikto-alternative" class="resetLink hover:text-emerald-300">Nikto</a></li><li><a href="/nuclei-alternative" class="resetLink hover:text-emerald-300">Nuclei</a></li><li><a href="/owasp-zap-alternative" class="resetLink hover:text-emerald-300">OWASP ZAP</a></li></ul></nav></div><div class="mt-12 flex flex-col gap-3 border-t border-white/10 pt-6 text-sm text-slate-500 sm:flex-row sm:items-center sm:justify-between"><p class="mb-0">© 2026 TheSmartScanner.com</p><div class="flex flex-wrap gap-x-5 gap-y-2"><a href="/terms" class="resetLink hover:text-slate-300">Terms of service</a><a href="/privacy" class="resetLink hover:text-slate-300">Privacy policy</a><a href="/eula" class="resetLink hover:text-slate-300">EULA</a><a href="/contact" class="resetLink hover:text-slate-300">Contact</a><span>Web security testing for modern applications</span></div></div></div></footer><link rel="prefetch" href="/assets/js/prism.js"><div id="cookieConsent" style="display:none;" class="flex py-4 px-4 lg:px-6 shadow-[0_-4px_8px_0px_rgba(0,0,0,0.1)] fixed bottom-0 left-0 w-full justify-between items-center flex-wrap lg:flex-nowrap gap-4 text-sm bg-white/60 backdrop-blur-md"><p class="text-base mx-auto m-0 pr-4 lg:pr-0">We use cookies to enhance quality of our services and to analyze traffic. Read our <a href="/privacy" class="resetLink underline">privacy policy</a>.</p><div class="flex gap-2 w-full lg:w-fit"><button onclick="consent.accept()" class="w-full lg:w-fit text-emerald-750 border border-emerald-750 rounded-[7px] h-10 min-w-24 flex items-center text-center justify-center bg-white transition-colors hover:text-emerald-750 hover:bg-emerald-25 active:bg-teal-100">OK, got it</button> <button onclick="consent.reject()" class="py-1 px-2 hover:text-black absolute top-3 right-2 lg:[position:initial]">X</button></div></div><script defer="defer" type="text/javascript" src="/assets/js/cookie.min.js"></script></body></html>]]></plaintext></p></div></div>