# CVE-2023-4771: CKEditor cross-site scripting in AJAX sample

Source: https://junglewise.ai/threats/cve-2023-4771-ckeditor-cross-site-scripting-in-ajax-sample  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-02-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-4771 · Severity: low · CVSS 3.1 · Published 2024-02-07

CKEditor is a widely-used rich text editor component embedded in web applications. A cross-site scripting (XSS) vulnerability exists in the AJAX sample file shipped with CKEditor 4, allowing an attacker to inject and execute malicious JavaScript code in users' browsers. Organizations that have deployed this sample code in production environments could be compromised.

Technologies: [ckeditor4 (npm)](https://junglewise.ai/threats/technologies/ckeditor4). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-4771 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-4771 being exploited in the wild.

**How severe is CVE-2023-4771?** Low severity, with a CVSS score of 3.1, published 7 February 2024.

**Which products and versions are affected?** ckeditor4 (npm) SEMVER:introduced=0,fixed=4.24.0-lts.

**Is there a fix for CVE-2023-4771?** Yes. ckeditor4 (npm): upgrade to 4.24.0-lts or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-4771 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-4771?** Check whether you run ckeditor4 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ckeditor4 (npm): upgrade to 4.24.0-lts or later

  ```sh
  npm install ckeditor4@4.24.0-lts
  ```


## Technical details

This is a cross-site scripting (CWE-79) vulnerability in the samples/old/ajax.html sample file shipped with CKEditor 4. The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript code via the AJAX sample when it is used in a production environment. The attack requires user interaction (the user must interact with the affected sample). The vulnerability affects all versions of CKEditor 4 prior to 4.24.0-lts. A fix was released in version 4.24.0-lts.

## Affected products

- CKSource CKEditor 4 < 4.24.0-lts

## Identifiers

- CVE-2023-4771
- GHSA-wh5w-82f3-wrxh

## Timeline

- 2024-02-07: disclosed
- 2024-02-07: patched: Fix available in version 4.24.0-lts

## References

- [https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-wh5w-82f3-wrxh](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-wh5w-82f3-wrxh)

## Related threats

- [CKEditor4 cross-site scripting via domain takeover](https://junglewise.ai/threats/cve-2024-43411-ckeditor4-cross-site-scripting-via-domain-takeover)
- [CKEditor 4 Code Snippet GeSHi plugin reflected XSS](https://junglewise.ai/threats/cve-2024-43407-ckeditor-4-code-snippet-geshi-plugin-reflected-xss)
- [CKEditor4 cross-site scripting in samples with preview feature](https://junglewise.ai/threats/cve-2024-24816-ckeditor4-cross-site-scripting-in-samples-with-preview-feature)
- [CKEditor4 cross-site scripting in HTML parsing with incorrect CDATA detection](https://junglewise.ai/threats/cve-2024-24815-ckeditor4-cross-site-scripting-in-html-parsing-with-incorrect)
- [CKEditor Cross-site Scripting in sample page](https://junglewise.ai/threats/ckeditor-cross-site-scripting-in-sample-page-ca465607)