XSS possible in Froala Editor v4.3.0 - CVE-2024-51434

[Path-17]

Expected behavior.

For the editor to be free of XSS

Actual behavior.

XSS is possible due to an issue when parsing <plaintext> tags.

Steps to reproduce the problem.

Paste the below payload into the "Code View" of the editor, then exit code view to render the HTML.

<plaintext><img src=1 onerror=alert(1)>

Editor version.

Current version, 4.3.0

OS

All

Browser.

Tested on Chrome and Firefox.

Recording.