CVE-2024-51434: Froala WYSIWYG editor allows cross-site… – CVSS 6.1 · Watchpost

← All vulnerabilities

Froala WYSIWYG editor allows cross-site scripting (XSS)

中危 6.1CVE-2024-51434 · GHSA-549p-5c7f-c5p4 · Published 07/11/2024 · updated 17/06/2026

要点

CVE-2024-51434 是影响 froala/wysiwyg-editor, froala-editor 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：0.38%，高于 31.5% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
froala/wysiwyg-editor Packagist	`≤ 4.3.0`	No fix yet
froala-editor npm	`≤ 4.3.0`	No fix yet

Description

Inconsistent <plaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.

NVD description

Inconsistent <plaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.

References

nvd.nist.gov/vuln/detail/CVE-2024-51434 · ADVISORY
georgyg.com/home/froala-wysiwyg-editor---xss-cve-2024-51434 · WEB
froala/wysiwyg-editor · PACKAGE
georgyg.com/home/froala-wysiwyg-editor---xss-cve-2024-51434

froala/wysiwyg-editor 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free