CVE-2024-21908

MediumCVSS 6.1

Published: 03/01/2024(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.07%

61th percentile - higher than 61% of all known CVEs

Summary

Stored XSS vulnerability in TinyMCE before version 5.9.0. An unauthenticated remote attacker can inject crafted HTML into the editor, leading to arbitrary JavaScript execution in another user's browser.

Risk Assessment

Risk of session theft, account takeover, or data leakage for users of the TinyMCE editor.

Recommendation

Immediately update TinyMCE to version 5.9.0 or later.

Original NVD description (English source)

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.