Medium severity · published Mar 5, 2026
CVE-2026-28343
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading to unauthorized JavaScript code execution, if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CK
Ckeditor5 · Ckeditor
before 47.6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-28343
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-28343
github.com
https://github.com/ckeditor/ckeditor5/releases/tag/v29.0.0
Release Notes
https://github.com/ckeditor/ckeditor5/releases/tag/v47.6.0
Mitigation
https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-jrqm-vmqc-gm93
More from Ckeditor5
8.1
CVE-2026-116688
CKEditor: Cross-site scripting (XSS) in the engine package
6.5
CVE-2021-21254
CKEditor 5 is an open source rich text editor framework with a modular architecture
6.1
CVE-2024-45613
CKEditor 5 is a JavaScript rich-text editor
5.4
CVE-2025-61261
A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via…
4.7
CVE-2022-31175
Cross-site scripting caused by the editor instance destroying process in ckeditor5