Description

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.

Remediation

References

CVE-2020-17480

Related Vulnerabilities

WordPress Plugin Easy Digital Downloads-Simple eCommerce for Selling Digital Files Multiple Security Bypass Vulnerabilities (2.1.10)

WordPress Plugin Arigato Autoresponder and Newsletter Cross-Site Scripting (2.7.1.1)

Oracle HTTP Server Other Vulnerability (CVE-2020-29506)

OpenVPN AS Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') Vulnerability (CVE-2020-11462)

WordPress Plugin AppPresser-Mobile App Framework Security Bypass (4.3.2)

Severity

Medium

Classification

CVE-2020-17480 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities