CVE-2024-21908 Cross-site scripting vulnerability in TinyMCE

2024-01-0315:38:09

CWE-79

VulnCheck

www.cve.org

tinymce

cross-site scripting

vulnerability

html

javascript

0.002 Low

EPSS

Percentile

57.4%

JSON

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user’s browser.

CNA Affected

[
  {
    "collectionURL": "https://nuget.org/packages",
    "defaultStatus": "unaffected",
    "packageName": "TinyMCE",
    "versions": [
      {
        "lessThan": "5.9.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver 2.0.0"
      }
    ]
  }
]