Wojciech Kukowski

**Name of the Vulnerable Software and Affected Versions** Drupal CKEditor 5 Premium Features versions 0.0.0 through 1.2.9 Drupal CKEditor 5 Premium Features versions 1.3.0 through 1.3.5 Drupal CKEditor 5 Premium Features versions 1.4.0 through 1.4.2 Drupal CKEditor 5 Premium Features versions 1.5.0 through 1.5.0 Drupal CKEditor 5 Premium Features versions 1.6.0 through 1.6.3 **Description** An issue exists in Drupal CKEditor 5 Premium Features that allows for functionality bypass through authentication bypass using an alternate path or channel. **Recommendations** Update Drupal CKEditor 5 Premium Features to version 1.2.10 or later. Update Drupal CKEditor 5 Premium Features to version 1.3.6 or later. Update Drupal CKEditor 5 Premium Features to version 1.4.3 or later. Update Drupal CKEditor 5 Premium Features to version 1.5.1 or later. Update Drupal CKEditor 5 Premium Features to version 1.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** CKEditor 4 LTS - WYSIWYG HTML editor versions 1.0.0 through 1.0.0 **Description** The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting (XSS). This enables attackers to inject malicious scripts into websites, potentially leading to unauthorized access or control. **Recommendations** For CKEditor 4 LTS - WYSIWYG HTML editor version 1.0.0, update to version 1.0.1 to resolve the issue.