A high-severity Cross-site Scripting (XSS) vulnerability in the TinyMCE rich text editor could allow an authenticated attacker to execute arbitrary scripts in a user's browser.

This is a CWE-79 Improper Neutralization of Input During Web Page Generation (XSS) vulnerability. The flaw requires a low-privileged authenticated user to interact with the editor, potentially leading to unauthorized actions or data theft via the victim's session.

Successful exploitation allows an attacker to bypass security controls by executing scripts within the victim's browser, potentially resulting in unauthorized data access or session hijacking. Given the CVSS score of 8.7, this vulnerability poses a significant risk to the integrity and confidentiality of applications utilizing the TinyMCE editor.

Immediate Action: Update TinyMCE to versions 7.9.3 or 8.5.1 immediately. Note that versions in the 5.x branch appear to lack a confirmed fix in the provided data.

Proactive Monitoring: Monitor application logs for unusual script injections or unexpected client-side behavior originating from the rich text editor component.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and use modern WAF rules to detect common XSS patterns.

Public Exploit Available: No (exploit_available: false)

Organizations should prioritize upgrading their TinyMCE integration to the latest patched versions (7.9.3 or 8.5.1) to eliminate the risk of XSS. If upgrading is not immediately possible, strict input sanitization and CSP enforcement are required to mitigate potential exploitation.