CVE-2024-21911

MediumCVSS 6.1

Published: 03/01/2024(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.17%

64th percentile - higher than 64% of all known CVEs

Summary

Stored XSS vulnerability in TinyMCE before version 5.6.0. An unauthenticated remote attacker can inject crafted HTML into the editor, leading to arbitrary JavaScript execution in another user's browser.

Risk Assessment

Risk of session theft, account takeover, or data leakage through malicious script execution in users' browsers.

Recommendation

Immediately update TinyMCE to version 5.6.0 or later to remediate this vulnerability.

Original NVD description (English source)

TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.