CVE-2023-37905 MEDIUM

CVE-2023-37905: Cross-site Scripting (XSS) in Source Mode of Editor in ckeditor-wordcount-plugin

Vendor W8Tcha
Product CKEditor-WordCount-Plugin
Weakness CWE-79 · XSS
Published July 21, 2023
Last update October 21, 2024
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin` plugin and users are advised to upgrade. There are no known workarounds for this vulnerability.

Key dates

02Disclosure timeline

July 21, 2023 CVE published
October 21, 2024 Record updated