Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19 results
Sep 18, 2026md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript.CVE-2026-84992 · Other software · imzbf · reported by GitHubMedium 6.1
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping or consistently quoting it. Both highlighted and non-highlighted rendering paths reach this return value, while XSSPlugin filters only existing html_block and html_inline tokens before rendering and therefore cannot inspect the renderer-generated HTML. An attacker who can supply Markdown can use crafted fenced-code metadata to execute JavaScript in the application origin when a victim renders it, including as stored cross-site scripting when the host persists the Markdown. This issue is fixed in version 6.5.4
- Product
- md-editor-v3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Codigo Markdown Editor 1.0.1 contains a code execution vulnerability that allows attackers to run arbitrary system commands by crafting a malicious markdown filCVE-2023-53940 · Other software · Alfonzm · reported by VulnCheckHigh 8.4
Codigo Markdown Editor 1.0.1 contains a code execution vulnerability that allows attackers to run arbitrary system commands by crafting a malicious markdown file. Attackers can embed a video source with an onerror event that executes shell commands through Node.js child_process module when the file is opened.
- Product
- Codigo Markdown Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Apr 9, 2025WP Editor.md – The Perfect WordPress Markdown Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31035 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Chris WP Editor.md – The Perfect WordPress Markdown Editor wp-editormd allows Stored XSS.This issue affects WP Editor.md – The Perfect WordPress Markdown Editor: from n/a through <= 10.2.1.
- Product
- WP Editor.md – The Perfect WordPress Markdown Editor
- Affected
- up to 10.2.1
- What to do
- Affects up to 10.2.1. Update WP Editor.md – The Perfect WordPress Markdown Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2024Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component.CVE-2024-41482 · Other software · Typora · reported by MITREMedium 6.1
Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component.CVE-2024-41481 · Other software · Typora · reported by MITREMedium 6.1
Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2024Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows attackers to execute arbitrary code by uCVE-2024-33300 · Other software · typora · reported by MITREHigh 7.3
Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows attackers to execute arbitrary code by uploading Markdown files.
- Product
- typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2023An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.CVE-2023-28873 · Other software · Seafile · reported by MITREMedium 5.4
An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.
- Product
- Seafile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.demanual.seafile.com
Sep 1, 2023A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via uploading a crafted CVE-2023-39703 · Other software · Typora · reported by MITREMedium 6.1
A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via uploading a crafted Markdown file.
- Product
- Typora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordc0olw.github.ioc0olw.github.io
Aug 11, 2023Cross Site Scripting (XSS) vulnerability in Rendering Engine in jbt Markdown Editor thru commit 2252418c27dffbb35147acd8ed324822b8919477, allows remote attackerCVE-2020-19952 · Other software · JBT · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in Rendering Engine in jbt Markdown Editor thru commit 2252418c27dffbb35147acd8ed324822b8919477, allows remote attackers to execute arbirary code via crafted payload or opening malicious .md file.
- Product
- Live (github-flavored) Markdown Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Cross Site Scripting vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via javascript code in the markdown editoCVE-2020-19277 · Other software · Mm-wiki Project · reported by MITREMedium 5.4
Cross Site Scripting vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via javascript code in the markdown editor.
- Product
- Mm-wiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023Cross Site Scripting vulnerability found in Markdown Edit allows a remote attacker to execute arbitrary code via the edit parameter of the webpage.CVE-2020-19947 · Other software · Markdown Edit Project · reported by MITRECritical 9.6
Cross Site Scripting vulnerability found in Markdown Edit allows a remote attacker to execute arbitrary code via the edit parameter of the webpage.
- Product
- Markdown Edit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Vditor is a browser-side Markdown editor.CVE-2021-32855 · Other software · npm · reported by GitHubMedium 6.1
Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. Version 3.8.7 contains a patch for this issue.
- Product
- vditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2022mm-wiki v0.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the markdown editor.CVE-2021-39393 · Other software · Mm-wiki Project · reported by MITREMedium 6.1
mm-wiki v0.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the markdown editor.
- Product
- Mm-wiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor.CVE-2022-24837 · Other software · hedgedoc · reported by GitHubMedium 5.3
HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes and affects all upload backends, except Lutim and imgur. This issue is patched in version 1.9.3 by replacing the filename generation with UUIDv4. If you cannot upgrade to HedgeDoc 1.9.3, it is possible to block POST requests to `/uploadimage`, which will disable future uploads.
- Product
- hedgedoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2021In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor.CVE-2021-25989 · Other software · ifmeorg · reported by vulnerabilitylab@mend.ioMedium 5.4
In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them.
- Product
- ifme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Apr 26, 2021HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor.CVE-2021-29474 · Other software · hedgedoc · reported by GitHubMedium 4.7
HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker can read arbitrary `.md` files from the server's filesystem due to an improper input validation, which results in the ability to perform a relative path traversal. To verify if you are affected, you can try to open the following URL: `http://localhost:3000/..%2F..%2FREADME#` (replace `http://localhost:3000` with your instance's base-URL e.g. `https://demo.hedgedoc.org/..%2F..%2FREADME#`). If you see a README page being rendered, you run an affected version. The attack works due the fact that the internal router passes the url-encoded alias to the `noteController.showNote`-function. This function passes the input directly to findNote() utility function, that will pass it on the the parseNoteId()-function, that tries to make sense out of the noteId/alias and check if a note already exists and if so, if a corresponding file on disk was updated. If no note exists the note creation-function is called, which pass this unvalidated alias, with a `.md` appended, into a path.join()-function which is read from the filesystem in the follow up routine and provides the pre-filled content of the new n
- Product
- hedgedoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2021HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor.CVE-2021-29475 · Other software · hedgedoc · reported by GitHubCritical 10
HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker is able to receive arbitrary files from the file system when exporting a note to PDF. Since the code injection has to take place as note content, there fore this exploit requires the attackers ability to modify a note. This will affect all instances, which have pdf export enabled. This issue has been fixed by https://github.com/hedgedoc/hedgedoc/commit/c1789474020a6d668d616464cb2da5e90e123f65 and is available in version 1.5.0. Starting the CodiMD/HedgeDoc instance with `CMD_ALLOW_PDF_EXPORT=false` or set `"allowPDFExport": false` in config.json can mitigate this issue for those who cannot upgrade. This exploit works because while PhantomJS doesn't actually render the `file:///` references to the PDF file itself, it still uses them internally, and exfiltration is possible, and easy through JavaScript rendering. The impact is pretty bad, as the attacker is able to read the CodiMD/HedgeDoc `config.json` file as well any other files on the filesystem. Even though the suggested Docker deploy option doesn't have many interesting files itself, the `config.json` still often contains sensitive i
- Product
- hedgedoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2020In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor.CVE-2020-11051 · Other software · Requarks · reported by GitHubMedium 6.9
In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor (with write access as well) load the same page into the Markdown editor, the XSS payload will be executed as part of the preview panel. The rendered result does not contain the XSS payload as it is stripped by the HTML Sanitization security module. This vulnerability only impacts editors loading the malicious page in the Markdown editor. This has been patched in 2.3.81.
- Product
- Wiki.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2020The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS.CVE-2018-19658 · Other software · Evernote · reported by MITREMedium 5.4
The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS. This behavior may be encountered by some Evernote users; however, it is a vulnerability in YXBJ, not a vulnerability in Evernote.
- Product
- Yinxiang Biji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyinxiang.comyinxiang.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.