CVE-2018-17960: Ckeditor

Medium severity, CVSS 6.1. EPSS: 1.9% chance of exploitation in the next 30 days.

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

Affected products

• Ckeditor Ckeditor: from 4.0, before 4.11.0 (fixed in 4.11.0)

Published 2018-11-14. Last modified 2026-06-17.