Froala WYSIWYG Editor XSS Vulnerability

MEDIUM 6.1CVE-2020-26523 · GHSA-qrhq-x7xh-2784 · Published 02/10/2020 · updated 17/06/2026

In short

CVE-2020-26523 is a MEDIUM (CVSS 6.1) vulnerability affecting froala/wysiwyg-editor, froala editor (froala).
Chance of exploitation in the next 30 days (EPSS): 0.69%, higher than 52.6% of all vulnerabilities.
Fix: update to 3.2.2 or later.

Package	Affected versions	Patched versions
froala/wysiwyg-editor Packagist	`< 3.2.2`	`3.2.2`
froala editor froala	`< 3.2.2`	`3.2.2`

Froala Editor before 3.2.2 allows XSS via pasted content.

NVD description

Froala Editor before 3.2.2 allows XSS via pasted content.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.