DXPR Builder - Moderately critical - Cross Site Scripting

CKEditor, a third-party JavaScript library included in DXPR Builder, has fixed multiple vulnerabilities since we last updated this library.  

We do not consider these vulnerabilities critical because the CKEditor library in our module is only accessed by users with "Edit with DXPR Builder" permission, and the editor only loads content on fields that have "DXPR Builder" set as field formatter. In order to exploit these vulnerabilities an attacker would need to have permission to edit content of a field that has "DXPR Builder" set as field formatter. This configuration would not be advisable.

CKEditor security releases included in this update:

• 4.16.0
• 4.15.1
• 4.14.0