Medium severity6.1NVD Advisory· Published Nov 16, 2023· Updated Jun 17, 2026

CVE-2023-4771

Description

A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
ckeditor4npm	< 4.24.0-lts	4.24.0-lts

Affected products

Cfmsource/Ckeditor2 versions
cpe:2.3:a:cksource:ckeditor:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:cksource:ckeditor:*:*:*:*:*:wordpress:*:*range: <=4.15.1
- (no CPE)range: 0
ghsa-coords
pkg:npm/ckeditor4
Range: < 4.24.0-lts

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-wh5w-82f3-wrxhghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-4771ghsaADVISORY
www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cksource-ckeditornvdThird Party AdvisoryWEB
github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cbghsaWEB
github.com/ckeditor/ckeditor4/security/advisories/GHSA-wh5w-82f3-wrxhghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000