CVE-2023-37905

MediumCVSS 6.1

Published: 21/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

38th percentile - higher than 38% of all known CVEs

Summary

The `ckeditor-wordcount-plugin` for CKEditor4 is susceptible to cross-site scripting (XSS) when switching to source code mode. This issue has been addressed in version 1.17.12 of the plugin.

Risk Assessment

Exploitation of this vulnerability could lead to unauthorized access to user data and allow attackers to execute malicious code in the victim's browser context.

Recommendation

It is recommended to upgrade the `ckeditor-wordcount-plugin` to version 1.17.12 to mitigate this vulnerability.

Original NVD description (English source)

ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin` plugin and users are advised to upgrade. There are no known workarounds for this vulnerability.