CVE-2006-6978: Cross-site scripting (XSS) vulnerability in the "Basic Toolbar Selection" in FCKEditor allows remote attack...

Security readout for executives and security teams

This is an old reported cross-site scripting issue in FCKEditor’s Basic Toolbar Selection. If a vulnerable editor is exposed to untrusted content, an attacker may cause JavaScript to run in another user’s browser. The source bundle does not identify affected versions, patch levels, or whether any deployments remain exposed. Most likely exposure is legacy applications still embedding FCKEditor or related rich-text editor components with Basic Toolbar Selection enabled. Exposure cannot be confirmed from the CVE metadata alone because affected products and versions are listed as unavailable. Make this a targeted legacy-application review item. It is not enough evidence for emergency response, but any exposed outdated editor handling user content should be remediated because browser-script execution can lead to account compromise or data exposure. Mitigation focus: Inventory applications using FCKEditor or legacy rich-text editor bundles.; Check vendor or project guidance for fixed versions and safe configuration.; Disable vulnerable toolbar features if still present and not required..

Prepared

Jun 29, 2026, 07:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.