CKEditor 4.20.1

Fixed Issues:

  • #5333: Fixed: The original name of the uploaded image is not preserved by the Upload Image plugin if the Clipboard plugin has enabled image handling.
  • #2881: Fixed: Changing table headers from "Both" to "First column" in the Table dialog does not change the first column cell correctly.
  • #2996: Fixed: Table header "scope" attribute is incorrect for the "Headers: both" option in the Table dialog.
  • #4802: Fixed: Tableselection caret moves to the previous cell after tabbing into the next cell and then removing its content.
  • #5365: Fixed: The value of the config.baseFloatZIndex config variable is incorrectly applied to parent dialog when the child dialog is closed resulting in the dialog overlay covering up the dialog. Thanks to JenoDK!
  • #5305: Fixed: Anchor name can invalidly include spaces.

CKEditor 4.20.0

New Features:

Fixed Issues:

  • #4889: Fixed: Incorrect position of the Table Resize cursor after scrolling the editor horizontally.
  • #5319: Fixed: Autolink config.autolink_urlRegex option produced invalid links when configured directly using the editor instance config. Thanks to Aigars Zeiza!
  • #4941: Fixed: Some entities got wrongly encoded when using entities_processNumerical = true configuration option.
  • #4931: Fixed: Selecting the whole editor content when there is only a list with an empty element at the end inside and deleting it did not delete all list items.

API changes:

CKEditor 4.19.1

Fixed Issues:

API changes:

  • #5184: Added the config.editorplaceholder_delay configuration option allowing to delay placeholder before it is toggled when changing editor content.
  • #5184: Added the function allowing to postpone a passed function execution until the given milliseconds have elapsed since the last time it was invoked.

CKEditor 4.19.0

New features:

Fixed Issues:

  • #4543: Fixed: Toolbar buttons toggle state is not correctly announced by screen readers lacking the information whether the feature is on or off.
  • #4052: Fixed: Editor labels are read incorrectly by screen readers due to invalid editor control type for the Iframe Editing Area editors.
  • #1904: Fixed: Screen readers are not announcing the read-only editor state.
  • #4904: Fixed: Table cell selection and navigation with the tab key behavior is inconsistent after adding a new row.
  • #3394: Fixed: Enhanced image plugin dialog is not supporting URL with query string parameters. Thanks to Simon Urli!
  • #5049: Fixed: The editor fails in strict mode due to not following the use strict directives in a core editor module.
  • #5095: Fixed: The clipboard plugin shows notification about unsupported file format when the file type is different than jpggifpng, not respecting supported types by the Upload Widget plugin.
  • #4855: [iOS] Fixed: Focusing toolbar buttons with an enabled VoiceOver screen reader moves the browser focus into an editable area and interrupts button functionality.

API changes:

CKEditor 4.18.0

Security Updates:

  • Fixed an XSS vulnerability in the core module reported by GitHub Security Lab team member Kevin Backhouse.

    Issue summary: The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing a JavaScript code. See CVE-2022-24728 for more details.

  • Fixed a Regular expression Denial of Service (ReDoS) vulnerability in dialog plugin discovered by the CKEditor 4 team during our regular security audit.

    Issue summary: The vulnerability allowed to abuse a dialog input validator regular expression, which could cause a significant performance drop resulting in a browser tab freeze. See CVE-2022-24729 for more details.

You can read more details in the relevant security advisory and contact us if you have more questions.

An upgrade is highly recommended!


Web Spell Checker ended support for WebSpellChecker Dialog on December 31st, 2021. This means the plugin is not supported any longer. Therefore, we decided to deprecate and remove the WebSpellChecker Dialog plugin from CKEditor 4 presets.

We strongly encourage everyone to choose one of the other available spellchecking solutions - Spell Check As You Type (SCAYT) or WProofreader.

Fixed issues:

Other changes:

  • #5093: Deprecated and removed WebSpellChecker Dialog from presets.
  • #5127: Deprecated the CKEDITOR.rnd property to discourage using it in a security-sensitive context.
  • #5087: Improved the jQuery adapter by replacing a deprecated jQuery API with existing counterparts. Thanks to Fran Boon!
  • #5128: Improved the Emoji definitions encoding set by the config.emoji_emojiListUrl configuration option.
Twitter Facebook Facebook Instagram Medium Linkedin GitHub Arrow down Phone Menu Close icon Check