Description
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
Remediation
References
Related Vulnerabilities
WordPress Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-6819)
WordPress Plugin API Bearer Auth Cross-Site Scripting (20181229)
Lighttpd NULL Pointer Dereference Vulnerability (CVE-2022-37797)
WordPress Plugin File Manager Remote Code Execution (4.5)
phpList Improper Neutralization of Formula Elements in a CSV File Vulnerability (CVE-2021-3188)