CVE-2020-9281

MediumCVSS 6.1

Published: 07/03/2020(UTC)Updated: 25/08/2026(UTC)Translated: 25/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

4.33%

90th percentile - higher than 90% of all known CVEs

Summary

CKEditor 4.0 before 4.14 contains a cross-site scripting (XSS) vulnerability in the HTML Data Processor. A remote attacker can inject arbitrary script through a crafted "protected" comment (with the cke_protected syntax).

Risk Assessment

An attacker can execute script in the victim's browser, potentially leading to session theft, account takeover, or content modification.

Recommendation

Update CKEditor to version 4.14 or later to mitigate the vulnerability.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).