Skip to main content
UNPWNED
Scan free
CVE Radar
MediumDrupal

CVE-2020-9281

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

CVSS Base Score
6.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploit Probability
90%EPSS PERCENTILE0100

More exploitable than 90% of all CVEs · Top 10%

Is your site exposed to this?

Run a free scan. UNPWNED fingerprints your stack and flags this CVE class if the affected technology is detected.

Check my site
Details
Published
2020-03-07
Last modified
2026-08-25
Affected
Drupal
References
NVD Detail OSV.dev GitHub Advisories

Related exploited CVEs in Drupal

CVE-2018-7602
Critical · 9.8 CVSSDrupal
CVE-2026-9082
Critical · 9.8 CVSSDrupal
CVE-2021-41184
Medium · 6.1 CVSSDrupal
CVE-2021-41182
Medium · 6.1 CVSSDrupal

Data from the National Vulnerability Database (NVD), CISA KEV, and FIRST.org EPSS. This product uses the NVD API but is not endorsed or certified by the NVD. EPSS is a probability estimate, not a guarantee of exploitation.