Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE

TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin. Only Silverstripe CMS 4 is affected by this issue. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE...

CVE-2016-7140

CVE-2016-7140 is a cross-site scripting (XSS) vulnerability in the ZMI page of Zope2 used by Plone CMS. The issue affects Plone versions 5.x up to 5.0.6, 4.x up to 4.3.11, and 3.3.x up to 3.3.6, enabling remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connecte...