Cross-site Scripting in Froala WYSIWYG Editor

MÉDIO 5.4CVE-2021-28114 · GHSA-rr6v-h7m8-wc9f · Published 16/07/2021 · updated 17/06/2026

Em resumo

CVE-2021-28114 é uma vulnerabilidade MÉDIO (CVSS 5.4) que afeta froala/wysiwyg-editor, froala editor (froala).
Chance de exploração nos próximos 30 dias (EPSS): 52.0%, maior que 99.0% das vulnerabilidades.
Correção: atualize para 3.2.7 ou posterior.

Package	Affected versions	Patched versions
froala/wysiwyg-editor Packagist	`< 3.2.7`	`3.2.7`
froala editor froala	`< 3.2.7`	`3.2.7`

Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.

NVD description

Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.