| Package | Affected versions | Patched versions |
|---|---|---|
| TinyMCE | ≥ 6.0.0, < 7.9.3≥ 8.0.0, < 8.5.1≤ 5.10.9 | 7.9.38.5.1 |
| tinymce/tinymce | ≥ 6.0.0, < 7.9.3≥ 8.0.0, < 8.5.1≤ 5.10.9 | 7.9.38.5.1 |
| tinymce | ≥ 6.0.0, < 7.9.3≥ 8.0.0, < 8.5.1< 5.11.1 | 7.9.38.5.15.11.1 |
| tinymce | ≥ 6.0.0, < 7.9.3≥ 8.0.0, < 8.5.1≤ 5.10.9 | 7.9.38.5.1 |
Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled.
This vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with data-mce-object and data-mce-p-* attributes are properly sanitized.
No official workaround available.
To avoid this vulnerability:
Tiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free