Vulnerability Report

CVE-2026-28343

Title: XSS in CKEditor 5 General HTML Support

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2026-28343.

CWE Category CWE-79

Published Date Mar 05, 2026

Modified Date Mar 19, 2026

Exploit Status Not Found

Score 6.4 CVSS v3.1

Exploit Probability (EPSS)

0.35%

Vulnerability Summary

CVE-2026-28343: CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.

Impacted Vendors

ckeditor 1

Reference Links

https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0 https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

6.4

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N