CVE-2024-21911 Cross-site scripting vulnerability in TinyMCE

2024-01-0315:59:00

CWE-79

VulnCheck

www.cve.org

tinymce

cross-site scripting

version 5.6.0

0.004 Low

EPSS

Percentile

73.3%

JSON

TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user’s browser.

CNA Affected

[
  {
    "collectionURL": "https://nuget.org/packages",
    "defaultStatus": "unaffected",
    "packageName": "TinyMCE",
    "versions": [
      {
        "lessThan": "5.6.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver 2.0.0"
      }
    ]
  }
]