🛡️ CVE-2023-28439
🟡 CVSS 4.7 — Medium ✅ No Known Exploit CWE-79 NVD
4.7
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting Iframe Dialog and Media Embed packages. The vulnerability may trigger a JavaScript code after fulfilling special conditions: using one of the affected packages on a web page with missing proper Content Security Policy configuration; initializing the editor on an element and using an element other than `