CVE-2020-17480
MEDIUMTinyMCE < 4.9.7 and 5.x < 5.1.4 - Cross-Site Scripting via Core Parser and Paste Plugin
Title source: llmDescription
TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.
References (2)
Core 2
Core References
Exploit, Release Notes, Third Party Advisory x_refsource_misc
https://github.com/tinymce/tinymce/security/advisories/GHSA-27gm-ghr9-4v95
Release Notes, Vendor Advisory x_refsource_misc
https://www.tiny.cloud/docs/release-notes/release-notes514/#securityfixes
Scores
CVSS v3
6.1
EPSS
0.0125
EPSS Percentile
66.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (2)
npm/tinymce
0 - 4.9.7npm
tiny/tinymce
< 4.9.7
Published
Aug 10, 2020
Tracked Since
Feb 18, 2026