Is ckeditor/ckeditor 4.3 vulnerable?
Composer · 3 releases from 4.3.3 to 4.3.5 · latest ckeditor/ckeditor is 4.25.1 · checked 2 Nov 2026
Yes: 4 known advisories
Yes. ckeditor/ckeditor 4.3.5, the last 4.3 release, is affected by 4 known security advisories (1 high, 3 medium), including CVE-2021-41165, CVE-2024-43407, CVE-2024-24815. Upgrade to 4.25.0 or later to fix all of them.
composer require ckeditor/ckeditor:^4.25.0Advisories affecting ckeditor/ckeditor 4.3.5
Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability
- Affected
- <4.25.0
- Fixed in
- 4.25.0
CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection
- Affected
- <4.24.0
- Fixed in
- 4.24.0
The Preview plugin in CKEditor allows Cross-site scripting (XSS)
- Affected
- <4.4.3
- Fixed in
- 4.4.3
HTML comments vulnerability allowing to execute JavaScript code
- Affected
- <4.17.0
- Fixed in
- 4.17.0
Which of your client projects are still on ckeditor/ckeditor 4.3?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact ckeditor/ckeditor version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other ckeditor/ckeditor versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.