Cross-site Scripting in Froala WYSIWYG Editor

MEDIO 5.4CVE-2021-28114 · GHSA-rr6v-h7m8-wc9f · Published 16/07/2021 · updated 17/06/2026

En resumen

CVE-2021-28114 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a froala/wysiwyg-editor, froala editor (froala).
Probabilidad de explotación en los próximos 30 días (EPSS): 52.0%, mayor que el 99.0% de las vulnerabilidades.
Solución: actualizar a 3.2.7 o posterior.

Package	Affected versions	Patched versions
froala/wysiwyg-editor Packagist	`< 3.2.7`	`3.2.7`
froala editor froala	`< 3.2.7`	`3.2.7`

Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.

NVD description

Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.