Description

A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.

Remediation

References

CVE-2025-61261

Related Vulnerabilities

WordPress 4.5.x PHP Object Injection (4.5 - 4.5.23)

Angular Inefficient Regular Expression Complexity Vulnerability (CVE-2024-21490)

Perl Integer Overflow to Buffer Overflow Vulnerability (CVE-2026-8376)

WordPress Plugin Easy Forms for MailChimp Cross-Site Scripting (6.1.2)

WordPress Plugin WP Statistics Multiple Cross-Site Scripting Vulnerabilities (2.2.4)

Severity

Medium

Classification

CVE-2025-61261 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities