Description
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.
Affected products
ckeditor: ckeditor; oracle: agile product lifecycle management; oracle: application express; oracle: banking party management; oracle: banking platform; oracle: commerce merchandising; oracle: financial services analytical applications infrastructure; oracle: jd edwards enterpriseone tools; oracle: peoplesoft enterprise peopletools
References10
- ckeditor.com/blog/CKEditor-4.15.1-with-a-security-patch-release… Release NotesVendor Advisory
- ckeditor.com/cke4/release/CKEditor-4.15.1 Release NotesVendor Advisory
- ckeditor.com/ckeditor-4/download/ Release NotesVendor Advisory
- ckeditor.com/blog/CKEditor-4.15.1-with-a-security-patch-release… Release NotesVendor Advisory
- ckeditor.com/cke4/release/CKEditor-4.15.1 Release NotesVendor Advisory
- ckeditor.com/ckeditor-4/download/ Release NotesVendor Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuApr2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
Metrics
- CVSS 3.1
-
6.1
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS — exploit probability
- 2% percentile: 81 · as of 11 November 2026
- CWE
- CWE-79
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.