Description

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.

Remediation

References

CVE-2020-17480

Related Vulnerabilities

Oracle Database Server CVE-2008-2602 Vulnerability (CVE-2008-2602)

WordPress Plugin MPL-Publisher-Create your Ebook & Audiobook Cross-Site Scripting (1.30.2)

MySQL CVE-2021-35575 Vulnerability (CVE-2021-35575)

Liferay Portal Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2025-43827)

concrete5 Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-22958)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2020-17480