CVE-2024-21910
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
An XSS vulnerability in TinyMCE before version 5.10.0 allows a remote, unauthenticated attacker to inject malicious JavaScript via crafted image or link URLs. The code executes in the browser of a user editing content.
Risk Assessment
An attacker could hijack user sessions, steal data, or perform unauthorized actions within the editor context, compromising content confidentiality and integrity.
Recommendation
Immediately update TinyMCE to version 5.10.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser.