Description
TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.
Remediation
References
https://github.com/tinymce/tinymce/security/advisories/GHSA-27gm-ghr9-4v95
https://www.tiny.cloud/docs/release-notes/release-notes514/#securityfixes
Related Vulnerabilities
CVE-2021-39176 Vulnerability in npm package detect-character-encoding
CVE-2020-28481 Vulnerability in npm package socket.io
CVE-2020-7684 Vulnerability in npm package rollup-plugin-serve
CVE-2020-36182 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2010-2076 Vulnerability in maven package org.apache.cxf:cxf-common-utilities