CVE-2024-21910: Cross-site scripting vulnerability in TinyMCE plugins

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-03 · updated 2026-07-14
Weakness: CWE-79

Description

TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser.

Affected products

tinymce: before 5.10.0 — fixed in 5.10.0

How to fix

Upgrade to a fixed version: tinymce 5.10.0. Check the vendor advisory for mitigations.

References

https://github.com/advisories/GHSA-r8hm-w5f7-wj39
https://github.com/jazzband/django-tinymce/issues/366
https://github.com/jazzband/django-tinymce/releases/tag/3.4.0
https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39
https://pypi.org/project/django-tinymce/3.4.0/
https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39
https://github.com/advisories/GHSA-r8hm-w5f7-wj39
https://github.com/jazzband/django-tinymce/issues/366
https://github.com/jazzband/django-tinymce/releases/tag/3.4.0
https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39
https://pypi.org/project/django-tinymce/3.4.0/
https://vulncheck.com/advisories/vc-advisory-GHSA-r8hm-w5f7-wj39

Get alerted when CVE-2024-21910 or the next vulnerability affects your stack