Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
CKEditor Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2026-28343 - Vulnerability Database
CKEditor

CKEditor Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2026-28343

Medium
Reference: CVE-2026-28343
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-28343
Title: CKEditor Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Prior to version 47.6.0 a cross-site scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup leading to unauthorized JavaScript code execution if the editor instance used an unsafe General HTML Support configuration. This issue has been patched in version 47.6.0.