CVE-2020-9281: Ckeditor

Medium severity, CVSS 6.1. EPSS: 4.3% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

Affected products

• Ckeditor Ckeditor: from 4.0, before 4.14 (fixed in 4.14)
• Drupal Drupal: from 8.7.0, before 8.7.12 (fixed in 8.7.12); from 8.8.0, before 8.8.4 (fixed in 8.8.4)
• Fedoraproject Fedora: version 30 only; version 31 only; version 32 only
• Oracle Agile Product Lifecycle Management: version 9.3.5 only; version 9.3.6 only
• Oracle Application Express: before 20.2 (fixed in 20.2)
• Oracle Banking Enterprise Default Management: version 2.6.2 only; version 2.7.0 only; version 2.7.1 only; version 2.10.0 only; version 2.12.0 only
• Oracle Banking Enterprise Default Managment: from 2.3.0, up to and including 2.4.0
• Oracle Jd Edwards Enterpriseone Tools: before 9.2.5.2 (fixed in 9.2.5.2)
• Oracle PeopleSoft Enterprise PeopleTools: affected versions not specified; version 8.56 only; version 8.57 only; version 8.58 only
• Oracle Siebel Apps - Customer Order Management: before 21.0 (fixed in 21.0)
• Oracle Webcenter Portal: version 11.1.1.9.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only

Published 2020-03-07. Last modified 2026-08-25.