Using the desktop MS Word, pasting is fine. Using the Online version, the HTML gets messed up with plenty of unneeded DOM attributes and additional elements.

It would be best if pasting provides a cleaner HTML as it is when pasting form the desktop MS Word.

This may result in invalid content being sent to the server or incorrect behavior of the client-side.

When the EnableTrackCahnges functionality of the Editor is set to true, a context menu is shown only if the user right-clicks over a tracked change. Clicking over a not changed element does not pop-up any context menu (neither the Editor's not the browser one). The issue is reproducible in all browsers.

Steps to reproduce:
1. Run the following configuration:

            <telerik:RadEditor ID="RadEditor1" runat="server" EnableTrackChanges="True">
                <Content>
                    <span>SPAN dssad</span>
                    <div>DIV fsdfksjdfkf</div>
                    <p>Paragraph jfdshfksjdhfksdhk</p>
                </Content>
            </telerik:RadEditor>

2. Right-click over a not track-changed element.

Actual result: No context menu is shown.

Expected result: The Editor's default content menu (or the browser on) is shown.

A possible workaround is to set the import step after all other rules in the CssFile of the RadEditor. CssFile would look like:

.h1
{
    background-color: Aqua;
}
.div
{
    color: Green;
}
@import url(StyleSheet.css);

Currently, this command switches from Design to HTML mode and vise versa when EditType="Inline".

In Normal editing mode this tool is disabled in the HTML mode and cannot be used, although it is useful and provides yet another layout option for the default look of the RadEditor.

You can test the additional layout option by running this example:

<telerik:RadEditor runat="server" ID="RadEditor1"
    EditModes="Design" OnClientModeChange="OnClientModeChange">
    <Tools>
        <telerik:EditorToolGroup>
            <telerik:EditorTool Name="Bold" />
            <telerik:EditorTool Name="ToggleEditMode" />
        </telerik:EditorToolGroup>
    </Tools>
</telerik:RadEditor>

<script type="text/javascript">
    function OnClientModeChange(sender, args) {
        setTimeout(function () {
            sender.get_toolAdapter().getToolByName("ToggleEditMode").set_enabled(true);
        },0)
    }
</script>

This tool can be redesigned to be available in the HTML mode in all cases not only when Inline editing mode is enabled.

Commonly users add empty anchor elements, e.g, <p><a name="anchor"></a>Some text</p>. By that, they provide a proper anchoring behavior in HTML, and prevent the text from being decorated as link.

The limitation here is that the anchor element cannot be selected, and thus unable to be edited via the LinkManager dialog.

It would be nice, if there is some built-in logic that handles this situation and provide a proper way for the end-users to be able to visually distinguish this anchors and edit them if needed.

You can find attached  a custom solution for such approach.

If a list with some non-default formatting in the bullet points is pasted, the custom formatting is not applied.

For example, changing the font-size of a bullet point in MS Word list, will be pasted only with relevant formatting in the text node, but will leave the <li> elements stripped out.

It would be nice if there is additional logic to apply the proper formatting in the bullet points accordingly to the one copied from MS Word.

In MS Word, if the entire list item is selected, changing the font-size will change the character's formatting too. While selecting only a text node (e.g., without highlighting) will not apply formatting to the list item.

In the RadEditor there is no option to somehow control the size of the bullet points. The only way is the user to switch to HTML mode and manually add font-size attribute in the <li> element.

It would be nice if there is a possibility to change the formatting similar to the editing experience in MS Word.

http://demos.telerik.com/aspnet-ajax/editor/examples/overview/defaultcs.aspx

1. Delete the content and create a list
2. Press Enter several times

Expected: The list is interrputed
Actual: The list cannot be interrupted

RadEditor produces invalid HTML when nesting lists in IE11 and IE10.

The validation error is: UL element cannot be nested within element UL

Setting invalid content into RadEditor leads to unexpected behavior such as content getting lost in certain situations.

Currently, if a paragraph has altered line-height in MS Word, pasting it into the RadEditor results to a normal paragraph with not affection to the line-height CSS property. 

RadEditor Find/Replace functionalities are not working in IE.


The following workaround could be used temporarily:
<script type="text/javascript">
            var $T = Telerik.Web.UI;
            Telerik.Web.UI.RadEditor.prototype.setActive = function () {
                if (this._emptyMessageContainer) this._hideEmptyMessage();
                if ($telerik.isIE && this.getSelection().isControl()) return;
                var curArea = this.get_mode() == $T.EditModes.Html ? this._getTextArea() : this.get_contentArea();
                if (curArea && curArea.setActive) curArea.setActive();
            };
            Telerik.Web.UI.RadEditor.prototype.setActiveIfElementIsNotInContent = function () {
                if (this._emptyMessageContainer) this._hideEmptyMessage();
                if ($telerik.isIE && this.getSelection().isControl()) return;
                var curArea = this.get_mode() == $T.EditModes.Html ? this._getTextArea() : this.get_contentArea();
                var activeElement = this.get_document().activeElement;
                var activeElementIsInContent = (activeElement && activeElement === curArea) || $.contains(curArea, activeElement);
                if (curArea && curArea.setActive && !activeElementIsInContent) {
                    curArea.setActive();
                }
            };

        </script>

Using the delete key in the content area of the RadEditor sometimes cause incorrect behavior to be encountered, e.g., content disappearance, incorrect elements to be removed etc.

For example pressing delete key before a list element, the li tag is removed, instead of just the cursor to be positioned in it.

This behavior comes from the browser and there is no RadEditor logic that interferes with it.

It would be nice if this inconsistencies are handled via custom commands that act more stable across browsers. 

The following issues are fixed with this item:

Pressing backspace in a table sometimes inserts non breaking spaces
Could not complete the operation due to error 800a025e when deleting table columns
Redundand nbsps are added to the content using backspace inside <ul> in IE9
IE10 crashes when nested lists are highlighted and deleted
Incorrect List nesting is generated when a Paragraph is deleted via backspace key under IE11

When using the Flash Manager to add a flash object into the content, causes the HTML mode to be non editable. 

The following example code is a possible workaround for this behavior:

<telerik:RadEditor ID="RadEditor1" runat="server" OnClientModeChange="OnClientModeChange">
</telerik:RadEditor>

<script type="text/javascript">
    function OnClientModeChange(editor, args) {
        var $ = $telerik.$,
            mode = editor.get_mode(),
            contentAreaElement = editor.get_contentArea(),
            editorModes = Telerik.Web.UI.EditModes;

        if (mode === editorModes.Html) {
            $(contentAreaElement).hide();
        } else {
            $(contentAreaElement).show();
        }
    }
</script>

Update: 

For securing the RadEditor content and preventing XSS attacks we advise enabling the RemoveScripts, EncodeScripts, StripCssExpressions and StripDomEventAttributes content filters to sanitize the content. For more information please check the following help article and blog post on the matter:
Prevent Cross-site Scripting (XSS)
Securing RadEditor Content and Preventing XSS Attacks.
 
Original message:
It is possible to conduct a successful XSS attack by injecting a specific malicious content in the RadEditor content. This attack targets Internet explorer browsers. It takes advantage of a security vulnerability related to the CSS expression rule in Legacy IE browsers, where arbitrary JavaScript code embedded in the style attribute of a DOM element can be run on the page.

There is a workaround that is strongly recommended to be used in order to make such attack attempts unsuccessful. The idea is to strip the expression declaration from the style attribute value of DOM elements in the RadEditor Content. Following is a sample implementation

Usage:

protected void Page_Load(object sender, EventArgs e)
{
	var sanitizer = new CssExpressionSanitizer();
	theEditor.Content = sanitizer.Sanitize(theEditor.Content);
}




Content of the CssExpressionSanitizer class:

public class CssExpressionSanitizer
{
	private static readonly Regex expressionPattern = new Regex(@"<[a-zA-Z0-9]+[^>]*?style=['""]?.*?(?<cssRule>[^;""]+: expression(?<bracket>\())", RegexOptions.Compiled);

	public string Sanitize(string input)
	{
		var matches = expressionPattern.Matches(input);
		for (int i = matches.Count - 1; i >= 0; i--)
		{
			input = SanitizeExpression(input, matches[i]);
		}

		return input;
	}

	private string SanitizeExpression(string input, Match m)
	{
		var cssRuleIndex = m.Groups["cssRule"].Index;
		var expressionIndex = m.Groups["bracket"].Index;

		input = StripMatchingBracketsWithContent(input, expressionIndex);
		input = input.Remove(cssRuleIndex, expressionIndex - cssRuleIndex);

		if (input[cssRuleIndex] == ';')
		{
			input = input.Remove(cssRuleIndex, 1);
		}

		return input;
	}

	private string StripMatchingBracketsWithContent(string input, int startIndex)
	{
		var openBrackets = 0;
		do
		{
			char currentChar = input[startIndex];
			if (currentChar == '"' || currentChar == '\'' || currentChar == '/')
			{ //strip within quotation marks making sure brackets appearing in string constructs do not interfere with the counting
				var parser = new InPairStringParser(currentChar);
				input = parser.Sanitize(input, startIndex);

				currentChar = input[startIndex];
			}
			input = input.Remove(startIndex, 1);

			if (currentChar == '(')
				openBrackets++;
			else if (currentChar == ')')
				openBrackets--;
		}
		while (openBrackets > 0 && input.Length > startIndex);

		return input;
	}

	public class InPairStringParser
	{
		public InPairStringParser(char pairChar)
		{
			this.pattern = new Regex(String.Format("{0}.*?(?<!\\\\){0}", pairChar));
		}

		public string Sanitize(string input, int startIndex)
		{
			var subinput = input.Substring(startIndex);

			return input.Substring(0, startIndex) + pattern.Replace(subinput, "", 1);
		}

		private readonly Regex pattern;
	}
}

When ToolbarMode is set to "RibbonBarFloating" the RadEditor height becomes greater than the control height. As a result the wrapper overlaps with the elements box below.

As a temporary workaround for ToolbarMode="RibbonBarFloating" only, the following JavaScript code need to be applied on the page:

   <script type="text/javascript">
            (function () {
                var getToolbarHeight = Telerik.Web.UI.Editor.UI.DimensionsCalculator.prototype._getToolbarHeight;
                Telerik.Web.UI.Editor.UI.DimensionsCalculator.prototype._getToolbarHeight = function (container) {
                    var $container = $telerik.$(container);
                    $container.append($container.find("div"));
                    return getToolbarHeight.call(this, container);
                }
            })();
</script>

Steps:
1. Add some track changes text using Author=User0 and UserCSSId="reU0".
2. Change the Author to "User1" and UserCSSId to "reU1". 
3. Click inside of User0's tracked text and start typing.

Results: The new text is displayed as if User0 wrote it, in User0's color.

Expected Result: The new text that was injected by User1 in the middle of User0's text would be have User1's color and hover text that pertains to User1. (Similar to how Word does it.)

The area shapes in Image Map Editor dialog couldn't be moved or resized in Internet Explorer 11.

Add a property for setting the default mode of RadEditor (Design, HTML, Previw). Currently this could be obtained using the approach in the following help article:

http://www.telerik.com/help/aspnet-ajax/editor-set-mode.html