CKEditor 4 was launched in 2012 and reached its End of Life (EOL) on June 30, 2023.
A special edition, CKEditor 4 LTS ("Long Term Support"), is available under commercial terms ("Extended Support Model") for anyone looking to extend the coverage of security updates and critical bug fixes.
With CKEditor 4 LTS, security updates and critical bug fixes are guaranteed until December 2026.
After June 30, 2023 the master version of the LICENSE.md file changed to reflect the license of CKEditor 4 LTS available under the Extended Support Model.
All future versions of CKEditor 4 (4.23.0-lts and above) are released as CKEditor 4 LTS distributions and require a license key.
The NPM package is tagged as 4.23.* without the -lts suffix, to keep it consistent with NPM versioning guidelines. Note that the version 4.23.0 and above are the LTS versions of the editor.
You may continue using CKEditor 4.22.* and below under the open source license terms. Please note, however, that the open source version no longer comes with any security updates, so your application will be at risk.
In order to install the open source version of CKEditor 4, use versions 4.22.1 and below. CKEditor 4.22.1 was the last version of CKEditor 4 available under the open source license terms.
CKEditor 5 is a great new editor with lots of exciting features.
Before upgrading, please be aware of the following changes:
You may continue using CKEditor 4.22.* (or below). The license terms of the older CKEditor 4 versions have not changed. However, please note that by using software that is no longer maintained, you are introducing a security risk to your application.
If you are not ready to replace CKEditor 4 in your application yet, you may continue using CKEditor 4 until December 2026. CKEditor 4 LTS, available under the "Extended Support Model", will ship all important security updates and critical bug fixes, providing an interrupted editing experience for your end users. Please note that this version of CKEditor 4 is available only under a special agreement and requires a license key.
A highly configurable WYSIWYG HTML editor with hundreds of features, from creating rich text content with captioned images, videos, tables, media embeds, emoji, or mentions to pasting from Word and Google Docs and drag&drop image upload.
It supports a broad range of browsers, including legacy ones.
npm install --save ckeditor4
Use it on your website:
<div id="editor">
<p>This is the editor content.</p>
</div>
<script src="./node_modules/ckeditor4/ckeditor.js"></script>
<script>
CKEDITOR.replace( 'editor' );
</script>
You can also load CKEditor 4 using CDN.
If you acquired the Extended Support Model for CKEditor 4 LTS, please read the CKEditor 4 LTS key activation guide.
In order to activate CKEditor 4 LTS, add licenseKey configure the editor with a valid license key:
<script>
CKEDITOR.replace( 'editor', {
licenseKey: 'your license key'
} );
</script>
The CKEditor 4 npm package comes in the standard-all preset, so it includes all official CKEditor plugins, with those from the standard package active by default.
If you are looking for CKEditor 5, here's a link to the relevant npm package: https://www.npmjs.com/package/ckeditor5
 IE / Edge |  Firefox |  Chrome | Chrome (Android) |  Safari |  iOS Safari |  Opera |
|---|---|---|---|---|---|---|
| IE8, IE9, IE10, IE11, Edge | latest version | latest version | latest version | latest version | latest version | latest version |
Find out more in the Browser Compatibility guide.
Copyright (c) 2003-2023, CKSource Holding sp. z o.o. All rights reserved.
For licensing, see LICENSE.md or https://ckeditor.com/legal/ckeditor-oss-license
CKEditor 4 until version 4.22.* was licensed under the terms of any of the following licenses of your choice:
CKEditor 4 LTS (starting from version 4.23.0-lts) is available under a commercial license only.
CKEditor 4.25.0-lts
⚠️️️ Please note that this release is a part of CKEditor 4 Extended Support Model, only available to customers who decided to acquire the LTS (Long Term Support) version of the editor. All editor versions below 4.25.0-lts can no longer be considered as secure! ⚠️
Security Updates:
Fixed reflected cross-site scripting (XSS) vulnerability in Code Snippet GeSHi plugin reported by Jiasheng He from Qihoo 360.
Issue summary: The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSHi library was included as a vendor dependency in CKEditor 4 source files. In a specific scenario, an attacker could craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP web server. See GHA for more details.
Fixed low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover
Issue summery: A theoretical vulnerability has been identified in CKEditor 4.22 (and above). In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an attack on CKEditor 4 instances. Although the vulnerability is purely hypothetical, we have addressed it in CKEditor 4.25.0-lts to ensure compliance with security best practices. See GHA for more details.
You can read more details in the relevant security advisories. Contact us if you have more questions.
An upgrade is highly recommended!
Updated dependencies:
CodeMirror (used only in the Toolbar Configurator in samples) has been updated to v5.65.17 for improved stability and performance.
Highlight.js (used by the Code Snippet plugin) has been updated to v11.9.0, introducing two breaking changes:
monokai_sublime is now monokai-sublime). Please verify the value of your config.codeSnippet_theme configuration option and adjust theme names as needed. The list of available themes can be checked in the plugins/codesnippet/lib/highlight/styles directory.FAQs
JavaScript WYSIWYG web text editor.
The npm package ckeditor4 receives a total of 44,641 weekly downloads. As such, ckeditor4 popularity was classified as popular.
We found that ckeditor4 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PyPI confirms no security flaws were exploited in the Ultralytics supply chain attack and highlights improvements for safer package publishing.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.