A high-severity Stored Cross-Site Scripting (XSS) vulnerability in the TinyMCE rich text editor could allow authenticated attackers to execute malicious scripts in the context of a user's session.

This is a Cross-Site Scripting (CWE-79) vulnerability. Per the CVSS vector (PR:L/UI:R), the attack requires an authenticated user with low privileges and user interaction, allowing the attacker to inject arbitrary scripts that execute when a victim views the affected content.

Successful exploitation allows an attacker to perform actions on behalf of the victim, potentially leading to unauthorized data access, session hijacking, or the modification of sensitive content within the application. With a CVSS score of 8.7, this flaw represents a significant risk to application integrity and user security, as it can be leveraged to compromise administrative sessions if the editor is used in a CMS or backend dashboard.

Immediate Action: Update the TinyMCE package to version 7.9.3 or 8.5.1 immediately to address the vulnerability.

Proactive Monitoring: Monitor application logs for suspicious script tags or encoded characters being injected into saved content fields.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter common XSS patterns.

Public Exploit Available: Unknown

Given the severity of this XSS vulnerability, organizations should prioritize updating their TinyMCE integration to the recommended patched versions. Failure to patch leaves applications susceptible to account takeover and data manipulation by malicious actors who gain access to the platform.