CVE-2024-21908

MediumCVSS 6.1/10Last modified Jul 14, 2026

Description

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
—	—	< 5.9.0

References

https://github.com/advisories/GHSA-5h9g-x5rv-25wgExploit, Third Party Advisory
https://github.com/tinymce/tinymce/security/advisories/GHSA-5h9g-x5rv-25wgExploit, Third Party Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-5h9g-x5rv-25wgThird Party Advisory
https://www.tiny.cloud/docs/release-notes/release-notes59/#securityfixesRelease Notes
https://github.com/advisories/GHSA-5h9g-x5rv-25wgExploit, Third Party Advisory
https://github.com/tinymce/tinymce/security/advisories/GHSA-5h9g-x5rv-25wgExploit, Third Party Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-5h9g-x5rv-25wgThird Party Advisory
https://www.tiny.cloud/docs/release-notes/release-notes59/#securityfixesRelease Notes

Timeline

Published: Jan 3, 2024
Last modified: Jul 14, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-219097.5PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service CVE-2024-21915.3An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and CVE-2024-219106.1TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce c CVE-2024-219116.1TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could inse CVE-2024-219127.8An arbitrary code execution vulnerability in Rockwell Automation Arena Simulation could let a malicious user insert unauthorized code into t CVE-2024-219137.8A heap-based memory buffer overflow vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user CVE-2024-219145.3A vulnerability exists in the affected product that allows a malicious user to restart the Rockwell Automation PanelView™ Plus 7 terminal re CVE-2024-219158.8A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with CVE-2024-219167.5A denial-of-service vulnerability exists in specific Rockwell Automation ControlLogix ang GuardLogix controllers. If exploited, the product CVE-2024-219179.1A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use CVE-2024-219187.8A memory buffer vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthoriz CVE-2024-219197.8An uninitialized pointer in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized co