CVE-2022-24728

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
ckeditor	ckeditor4	< 4.18.0

References

https://ckeditor.com/cke4/release/CKEditor-4.18.0Release Notes, Vendor Advisory
https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949Patch, Third Party Advisory
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
https://www.drupal.org/sa-core-2022-005Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
https://ckeditor.com/cke4/release/CKEditor-4.18.0Release Notes, Vendor Advisory
https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949Patch, Third Party Advisory
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
https://www.drupal.org/sa-core-2022-005Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Timeline

Published: Mar 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-247297.5CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dia CVE-2022-24734.8The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in ver CVE-2022-247306.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.CVE-2022-247314.9Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.CVE-2022-247328.8Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or accou CVE-2022-247336.1Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attac CVE-2022-247347.2MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting type CVE-2022-247357.8Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with acc CVE-2022-247365.5Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted CVE-2022-247376.5HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state CVE-2022-247387.4Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain uncla CVE-2022-247396.1alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an op