In short
- CVE-2023-37905 is a MEDIUM (CVSS 6.1) vulnerability affecting ckeditor-wordcount-plugin (ckeditor-wordcount-plugin project), ckeditor-wordcount-plugin.
- Chance of exploitation in the next 30 days (EPSS): 0.57%, higher than 47.3% of all vulnerabilities.
- Fix: update to 1.17.12 or later.
Description
Problem
It has been discovered that the ckeditor-wordcount-plugin plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode.
Solution
Update to version 1.17.12 of the ckeditor-wordcount-plugin plugin.
Credits
- @sypets for reporting this finding to the TYPO3 Security Team
- @ohader for fixing the issue on behalf of the TYPO3 Security Team
NVD description
ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin` plugin and users are advised to upgrade. There are no known workarounds for this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free