Cross-site Scripting in Froala WYSIWYG Editor

MEDIUM 5.4CVE-2021-28114 · GHSA-rr6v-h7m8-wc9f · Published 16/07/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
froala/wysiwyg-editor Packagist	`< 3.2.7`	`3.2.7`
froala editor froala	`< 3.2.7`	`3.2.7`

Description

Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.

NVD description

Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.