← Vulnerability feed

Vulnerability record · CVE-2024-24815 · published 7 February 2024

CVE-2024-24815: Ckeditor cross-site scripting vulnerability

Ckeditor · Ckeditor

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.

6.1 CVSS 3.1 Medium EPSS 0.71% · top 48.5% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score
0.71%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References
17 Jun 2026Last modified by NVD

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S-cdata Product
https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html Product
https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filter.html Product
https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb Patch
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qqvm Vendor Advisory
https://www.drupal.org/sa-contrib-2024-009
https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S-cdata Product
https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html Product
https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filter.html Product
https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb Patch
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qqvm Vendor Advisory
https://www.drupal.org/sa-contrib-2024-009

Track CVE-2024-24815 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-31541Ckeditor unrestricted file upload vulnerabilityA unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which al…EPSS 1.4%7.5CVE-2022-24729Ckeditor uncontrolled resource consumption vulnerabilityCKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plug…EPSS 2.5%7.5CVE-2011-4972Ckeditor information exposure vulnerabilityhook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to rea…EPSS 1.7%6.8CVE-2012-2067Fckeditor vulnerabilityUnspecified vulnerability in the CKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for…EPSS 1.5%6.5CVE-2021-26271Ckeditor inclusion from untrusted sphere vulnerabilityIt was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of sp…EPSS 2.0%6.5CVE-2021-26272Ckeditor inclusion from untrusted sphere vulnerabilityIt was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, a…EPSS 2.2%6.1CVE-2024-43407Ckeditor cross-site scripting vulnerabilityCKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi …EPSS 0.45%6.1CVE-2024-24816Ckeditor cross-site scripting vulnerabilityCKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versi…EPSS 1.7%

Source: NIST National Vulnerability Database (record CVE-2024-24815), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.