{"id":"CVE-2020-9440","details":"A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor.","modified":"2026-10-24T10:30:31.939294552Z","published":"2020-03-10T17:15:13.207Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:webspellchecker:webspellchecker:*:*:*:*:*:*:*:*"],"extracted_events":[{"range":[{"last_affected":"5.5.7.5"}],"source":"CPE_RANGE"}],"vendor_product":"webspellchecker:webspellchecker"},{"vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"],"extracted_events":[{"source":"CPE_STRING","range":[{"introduced":"30"},{"last_affected":"30"},{"introduced":"31"},{"last_affected":"31"},{"introduced":"32"},{"last_affected":"32"}]}]}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OJ4BSS3VEAEXPNSOOUAXX6RDNECGZNO/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L322YA73LCV3TO7ORY45WQDAFJVNKXBE/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4HHYQ6N452XTCIROFMJOTYEUWSB6FR4/"},{"type":"ADVISORY","url":"https://ckeditor.com/blog/CKEditor-4.14-with-Paste-from-LibreOffice-released/#security-issues-fixed"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ckeditor/ckeditor4","events":[{"introduced":"769d96134bcf29f5d3d870e25797ce9b9dc8289e"},{"last_affected":"769d96134bcf29f5d3d870e25797ce9b9dc8289e"}],"database_specific":{"extracted_events":[{"source":"CPE_STRING","cpe":"cpe:2.3:a:ckeditor:ckeditor:4.0:*:*:*:*:*:*:*","range":[{"introduced":"4.0"},{"last_affected":"4.0"}]}]}}],"versions":["4.0","4.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9440.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ckeditor/ckeditor4-releases","events":[{"introduced":"870a561110a23435d78eda377400dca7f64d3bd3"},{"last_affected":"870a561110a23435d78eda377400dca7f64d3bd3"}],"database_specific":{"extracted_events":[{"source":"CPE_STRING","cpe":"cpe:2.3:a:ckeditor:ckeditor:4.0:*:*:*:*:*:*:*","range":[{"introduced":"4.0"},{"last_affected":"4.0"}]}]}}],"versions":["4.0","4.0/standard"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9440.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}