TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled. Patches This vulnerability has been...