A high-severity Cross-Site Scripting (XSS) vulnerability in TinyMCE allows authenticated attackers to execute unauthorized scripts, posing a significant risk to application and user session security.

This vulnerability is classified as CWE-79 (Cross-site Scripting). The attack vector requires low privileges (PR:L) and user interaction (UI:R), meaning an authenticated attacker must trick a user into interacting with the malicious payload.

An attacker exploiting this vulnerability could gain unauthorized access to sensitive information or perform administrative actions if the victim holds high privileges. The CVSS score of 8.7 reflects the potential for severe impact on the confidentiality and integrity of the web application.

Immediate Action: Upgrade to version 7.9.3 or 8.5.1. Note that versions in the 5.x branch appear to lack a specific fix; users on this branch should migrate to a supported version.

Proactive Monitoring: Review application logs for unexpected script execution or unauthorized modifications to content managed by the editor.

Compensating Controls: Deploy a robust Content Security Policy (CSP) and utilize WAF rules to block malicious input patterns commonly associated with XSS attacks.

Public Exploit Available: Unknown

Organizations must move to patch this vulnerability immediately to prevent potential exploitation. For users on older 5.x versions, a migration to the 7.x or 8.x branches is strongly recommended to ensure long-term security.