React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button

Description

All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the <iframe> tag.

Recommendation

No fix is available yet. Followings are affected versions:

<= 1.15.0

References

GHSA-fq5x-7292-2p5r
security.snyk.io
CVE-2025-3191
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button and gives you actionable findings to investigate.

Start a free scan

Related Issues

Cross-site Scripting in React Draft Wysiwyg - CVE-2021-31712
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia - vega-expression - CVE-2025-59840
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia - CVE-2025-59840
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia - vega-interpreter - CVE-2025-59840

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated April 04, 2025