Minseok Kim

**Name of the Vulnerable Software and Affected Versions** CKEditor 5 versions prior to 47.6.0 **Description** CKEditor 5, a JavaScript rich-text editor, contains a cross-site scripting (XSS) issue within the General HTML Support feature. This issue arises from the insertion of specially crafted markup, potentially leading to unauthorized JavaScript code execution. The vulnerability is triggered when the editor is configured to use an unsafe General HTML Support configuration. The issue affects installations where General HTML Support is enabled and configured to allow unsafe markup. **Recommendations** Versions prior to 47.6.0 should be updated to version 47.6.0 or later. Configure General HTML Support securely to prevent the acceptance of unsafe content.

**Name of the Vulnerable Software and Affected Versions** Markup Markdown WordPress plugin versions prior to 3.20.10 **Description** The plugin allows links to contain JavaScript, potentially enabling users with contributor or higher roles to execute Stored Cross-Site Scripting attacks. **Recommendations** Update the Markup Markdown WordPress plugin to version 3.20.10 or later.

**Nome do Software Vulnerável e Versões Afetadas** DAEXT Import Markdown versões até a 1.14 **Descrição** O software contém uma falha devido ao tratamento inadequado de dados fornecidos pelo usuário ao criar páginas web, resultando em uma condição de Cross-Site Scripting (XSS) Armazenado. Isso permite que um atacante injete scripts maliciosos em páginas web visualizadas por outros usuários. O componente afetado é o Import Markdown. **Recomendações** Atualize para uma versão posterior à 1.14.