CVE-2018-6464

Name of the Vulnerable Software and Affected Versions Simditor version 2.3.11

Description The issue allows for XSS via crafted use of svg/onload=alert in a TEXTAREA element. This has been demonstrated using Firefox 54.0.1.

Recommendations For Simditor version 2.3.11, consider disabling the use of SVG elements in TEXTAREA fields until a patch is available. Restrict access to the TEXTAREA element to minimize the risk of exploitation. Avoid using the onload event in SVG elements within the TEXTAREA element until the issue is resolved.