CVE-2020-9440: Ckeditor

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor.

Affected products

• Ckeditor Ckeditor: version 4.0 only
• Fedoraproject Fedora: version 30 only; version 31 only; version 32 only
• Webspellchecker Webspellchecker: up to and including 5.5.7.5

Published 2020-03-10. Last modified 2026-06-17.