UEditor versions up to 1.4.3.2 are vulnerable to cross‑site scripting due to improper validation of the "callback" query argument in the JSONP callback handler (controller.php?action=uploadimage). An attacker can supply a crafted callback value that leads to arbitrary script execution in a victim's browser. The vulnerability is a classic XSS flaw (CWE‑79). No evidence of remote code execution or privilege escalation is provided in the description.

Affected vendors: UEditor. Affected product versions: any version up to and including 1.4.3.2. These versions are no longer supported by the maintainer, so no official patch is provided by the vendor.

The CVSS score 5.1 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation likelihood is low. The vulnerability can be triggered remotely via a crafted URL, and public exploit code is available. The vulnerability is currently not listed in the CISA KEV catalog, implying it may not be widely exploited in the wild yet.