Reflected cross-site scripting (XSS) In ckeditor-wordcount-plugin
Description
ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor
Problem
It has been discovered that the ckeditor-wordcount-plugin plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode.
Solution
Update to version 1.17.12 of the ckeditor-wordcount-plugin plugin.
Credits
@sypets for reporting this finding to the TYPO3 Security Team
@ohader for fixing the issue on behalf of the TYPO3 Security Team
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 npm | 1.17.12 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5.