CVE-2026-28343— CKEditor: Cross-site scripting (XSS) in the HTML Support package
Quick assessment
Affected
ckeditor ckeditor5
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CKEditor是CKEditor开源的一个企业级 WYSIWYG 编辑器。 CKEditor 5 47.6.0之前版本存在跨站脚本漏洞，该漏洞源于General HTML Support功能存在跨站脚本，可能导致执行未经授权的JavaScript代码。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-28343
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CKEditor: Cross-site scripting (XSS) in the HTML Support package
Source: CVE Program / CVE List V5
Vulnerability Description
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
CKEditor 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CKEditor是CKEditor开源的一个企业级 WYSIWYG 编辑器。 CKEditor 5 47.6.0之前版本存在跨站脚本漏洞，该漏洞源于General HTML Support功能存在跨站脚本，可能导致执行未经授权的JavaScript代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-28343
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-28343
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-28343 (1)
Vendor Pages for CVE-2026-28343 (2)
-
Release v47.6.0 · ckeditor/ckeditor5 · GitHub x_refsource_MISC
-
Release v29.0.0 · ckeditor/ckeditor5 · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: ckeditor5
-
CVE-2025-58064
CKEditor is susceptible to Cross-Site Scripting (XSS) throug -
CVE-2025-25299
Cross-site scripting (XSS) in the real-time collaboration pa -
CVE-2024-45613
CKEditor 5 has Cross-site Scripting vulnerability in the cli -
CVE-2022-31175
Cross-site scripting caused by the editor instance destroyin -
CVE-2021-21391
Regular expression Denial of Service in multiple packages
Same vendor: ckeditor
-
CVE-2025-58064
CKEditor is susceptible to Cross-Site Scripting (XSS) throug -
CVE-2025-25299
Cross-site scripting (XSS) in the real-time collaboration pa -
CVE-2024-45613
CKEditor 5 has Cross-site Scripting vulnerability in the cli -
CVE-2024-43411
CKEditor4 has a low risk cross-site scripting (XSS) vulnerab -
CVE-2024-43407
Code Snippet GeSHi plugin has reflected cross-site scripting
Same weakness: CWE-79
-
CVE-2026-107272
Gophish through 0.12.1 XSS via Unescaped SMTP Server Error M -
CVE-2026-102258
SMA1000 AMC存储型XSS漏洞 -
CVE-2026-104393
WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cros -
CVE-2026-105875
WordPress Prime Slider – Addons For Elementor plugin <= 4.6. -
CVE-2026-104391
WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Si
V. Comments for CVE-2026-28343
No comments yet