Every CVE Search/ Get API key

CVE-2018-17960

Ckeditor XSS Vulnerability

6.1 MediumFix available

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.95%Up 0.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

Record
CVE-2018-17960
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

Record
CVE-2018-17960
Updated
2026-11-02
EUVDEUVD-2018-0752 No score

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

Record
EUVD-2018-0752
Updated
2026-11-03
GitHub AdvisoriesGHSA-g68x-vvqq-pvw3 6.1

Ckeditor XSS Vulnerability

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. It was possible to execute XSS inside the CKEditor source area after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode. Although this is an unlikely scenario, it is recommended to upgrade to the latest editor version.

Record
GHSA-g68x-vvqq-pvw3
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.1

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

Record
CVE-2018-17960
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-17960 6.1

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

Record
DEBIAN-CVE-2018-17960
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-g68x-vvqq-pvw3 6.1

Ckeditor XSS Vulnerability

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste. It was possible to execute XSS inside the CKEditor source area after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode. Although this is an unlikely scenario, it is recommended to upgrade to the latest editor version.

Record
GHSA-g68x-vvqq-pvw3
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2018-17960 6.1

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

Record
UBUNTU-CVE-2018-17960
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1782262731 No score

TuxCare security update for ckeditor (1 CVE)

TuxCare rebuilt ckeditor to address 1 CVE. Fixed in 4.5.11-tuxcare.1.

Record
CLSA-2026-1782262731
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ckeditor
npm
 before 4.11.0
4.11.0
typo3/cms-core
Packagist
 8.0.0 up to 8.7.21
8.7.21
typo3/cms-core
Packagist
 9.0.0 up to 9.5.2
9.5.2
typo3/cms
Packagist
 8.0.0 up to 8.7.21
8.7.21
typo3/cms
Packagist
 9.0.0 up to 9.5.2
9.5.2
ckeditor
TuxCare:npm
 4.5.11-tuxcare.0 up to 4.5.11-tuxcare.1, plus listed versions
4.5.11
4.5.11-tuxcare.1
ckeditor
Debian:12
 before 4.11.1+dfsg-1
4.11.1+dfsg-1
ckeditor3
Debian:12
 All versions, plus listed versions
3.6.6.1+dfsg-7
 None known
typo3/cms-core
Packagist
 8.0.0 up to 8.7.21, plus listed versions
v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14
Show 9 moreShow less
v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.7v8.7.8v8.7.9
8.7.21
typo3/cms-core
Packagist
 9.0.0 up to 9.5.2, plus listed versions
v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0
Show 6 moreShow less
v9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1
9.5.2
Show 4 moreShow less
Affected packages
PackageAffectedFixed
typo3/cms
Packagist
 8.0.0 up to 8.7.21, plus listed versions
8.0.18.1.08.1.18.1.28.2.0
Show 30 moreShow less
8.2.18.3.08.3.18.4.08.4.18.5.08.5.18.6.08.6.18.7.08.7.18.7.2v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.3v8.7.4v8.7.5v8.7.6v8.7.7v8.7.8v8.7.9
8.7.21
typo3/cms
Packagist
 9.0.0 up to 9.5.2, plus listed versions
v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0
Show 6 moreShow less
v9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1
9.5.2
ckeditor
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.4.4+dfsg1-34.5.6+dfsg-14.5.7+dfsg-14.5.7+dfsg-24.5.7+dfsg-2ubuntu0.16.04.1~esm14.5.7+dfsg-2ubuntu0.16.04.1~esm24.5.7+dfsg-2ubuntu0.16.04.1~esm3
 None known
ckeditor
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.5.7+dfsg-24.5.7+dfsg-2ubuntu0.18.04.14.5.7+dfsg-2ubuntu0.18.04.1+esm14.5.7+dfsg-2ubuntu0.18.04.1+esm2
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-17960 is a medium vulnerability (CVSS 6.1) in Ckeditor, published November 14, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.95%, the 80th percentile. Fixed in ckeditor 4.11.0.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open