CVE-2021-30109

MediumCVSS 6.1

Published: 05/04/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.05%

60th percentile - higher than 60% of all known CVEs

Summary

Froala Editor 3.2.6 is vulnerable to persistent XSS. A crafted base64 string in the hyperlink creation module allows injection of malicious scripts.

Risk Assessment

An attacker can persistently inject malicious JavaScript into the editor, leading to session theft, redirects, or content modification visible to other users.

Recommendation

Update Froala Editor to a version newer than 3.2.6 where this vulnerability is fixed. If updating is not possible, restrict editor access and apply input filtering.

Original NVD description (English source)

Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.