CVE-2024-21910CWE-79

Cross-site scripting vulnerability in TinyMCE plugins

Medium · published January 3, 2024

CVSS v3.1
6.1
EPSS
1%
Percentile
61.0
In the wild
Unconfirmed
What it is

TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00956 · 61.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-01-03T15:55Z
EPSS history
Timeline
  • 03 JAN 15:55Z
    Cross-site scripting vulnerability in TinyMCE plugins
    cvelistv5