Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

ckeditor-wordcount-plugin

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.1npmAmendedPublished

    ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor

    CVE-2023-37905 · GHSA-q9w4-w667-qqj4

    Affected
    • npm ckeditor-wordcount-plugin <= 1.17.11
    Fixed in
    1.17.12· Vendor fix available
    Issue
    Problem It has been discovered that the ckeditor-wordcount-plugin plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. Solution Update to version 1.17.12 of the ckeditor-wordcount-plugin plugin. Credits @sypets for reporting this finding to the TYPO3 Security Team @ohader for fixing the issue on behalf of the TYPO3 Security Team

    Recommended action: Upgrade to 1.17.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →