EIP-2026-105865

This is a functional XSS PoC for CKEditor 4.0.1, demonstrating how unsanitized user input in form fields can execute arbitrary JavaScript in the context of the affected site. The exploit uses a hidden form input with a script tag to trigger an alert upon page load.