CVE-2025-3191 - All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the <iframe> tag

Back Back to CVE browser

MEDIUM

All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the <iframe> tag

Published Apr 4, 2025

5.1

MEDIUM

CVSS 4.0

EPSS 0.24%

Description

All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the <iframe> tag.

Affected products

Vendor n/a Product React-Draft-Wysiwyg Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

React-Draft-Wysiwyg

n/a

Version	Status	Constraints
0	affected	<*

Ecosystem	Package	Introduced	Fixed
npm	react-draft-wysiwyg	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

Link	Providers	Tags
https://gist.github.com/th4s1s/175ae4b2632096059b42377dd6c49d47		exploit
https://github.com/advisories/GHSA-fq5x-7292-2p5r		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-3191
https://security.snyk.io/vuln/SNYK-JS-REACTDRAFTWYSIWYG-8515884