Description

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.

Remediation

References

CVE-2024-21908

Related Vulnerabilities

PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-15132)

WordPress Plugin White Label CMS Cross-Site Scripting (2.2.8)

Apache Traffic Server Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2018-8004)

WordPress Plugin User Role by BestWebSoft Cross-Site Scripting (1.5.5)

Joomla CVE-2019-14654 Vulnerability (CVE-2019-14654)

Severity

Medium

Classification

CVE-2024-21908 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities