# CKEditor Cross-site Scripting in sample page

Source: https://junglewise.ai/threats/ckeditor-cross-site-scripting-in-sample-page-ca465607  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-11-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2023-11-16

CKEditor is a popular rich-text editor used in web applications to allow users to create and format content. A cross-site scripting vulnerability in CKEditor's sample page could allow an attacker to inject malicious JavaScript code that steals authorized users' sensitive information when they visit or interact with the vulnerable page.

Technologies: [ckeditor4 (npm)](https://junglewise.ai/threats/technologies/ckeditor4). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 16 November 2023.

**Which products and versions are affected?** ckeditor4 (npm) SEMVER:introduced=0,last_affected=4.15.1.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run ckeditor4 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cross-site scripting (XSS) vulnerability exists in CKEditor versions 4.15.1 and earlier, specifically in the /ckeditor/samples/old/ajax.html sample file. The vulnerability allows an attacker to inject and execute arbitrary JavaScript code through this sample page (CWE-79). The attack requires user interaction—a user must visit a page containing the malicious payload—but has no authentication requirements. A successful exploit enables attackers to steal session tokens, credentials, or other sensitive data from authenticated users. The vulnerability is marked as a duplicate of GHSA-wh5w-82f3-wrxh; patches are available in patched versions of CKEditor 4.

## Affected products

- CKSource CKEditor 4.15.1 and earlier

## Timeline

- 2023-11-16: disclosed
- 2024-02-07: other: Advisory withdrawn as duplicate of GHSA-wh5w-82f3-wrxh

## References

- [https://github.com/ckeditor/ckeditor4-releases](https://github.com/ckeditor/ckeditor4-releases)

## Related threats

- [CKEditor4 cross-site scripting via domain takeover](https://junglewise.ai/threats/cve-2024-43411-ckeditor4-cross-site-scripting-via-domain-takeover)
- [CKEditor 4 Code Snippet GeSHi plugin reflected XSS](https://junglewise.ai/threats/cve-2024-43407-ckeditor-4-code-snippet-geshi-plugin-reflected-xss)
- [CKEditor cross-site scripting in AJAX sample](https://junglewise.ai/threats/cve-2023-4771-ckeditor-cross-site-scripting-in-ajax-sample)
- [CKEditor4 cross-site scripting in samples with preview feature](https://junglewise.ai/threats/cve-2024-24816-ckeditor4-cross-site-scripting-in-samples-with-preview-feature)
- [CKEditor4 cross-site scripting in HTML parsing with incorrect CDATA detection](https://junglewise.ai/threats/cve-2024-24815-ckeditor4-cross-site-scripting-in-html-parsing-with-incorrect)