CVE-2021-32808: Ckeditor

Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days.

ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0. The problem has been recognized and patched. The fix will be available in version 4.16.2.

Affected products

• Ckeditor Ckeditor: from 4.13.0, before 4.16.2 (fixed in 4.16.2)
• Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
• Oracle Application Express: before 21.1.4 (fixed in 21.1.4)
• Oracle Banking Party Management: version 2.7.0 only
• Oracle Commerce Guided Search: version 11.3.2 only
• Oracle Commerce Merchandising: version 11.3.2 only
• Oracle Documaker: version 12.6.3 only; version 12.6.4 only
• Oracle Financial Services Analytical Applications Infrastructure: from 8.0.7, up to and including 8.1.1
• Oracle Financial Services Model Management And Governance: version 8.0.8.0.0 only; version 8.1.0.0.0 only
• Oracle Jd Edwards Enterpriseone Tools: up to and including 9.2.6.0
• Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only
• Oracle Siebel UI Framework: up to and including 21.9
• Oracle Webcenter Sites: version 12.2.1.3.0 only; version 12.2.1.4.0 only

Published 2021-08-12. Last modified 2026-06-17.