The vulnerability permits persistent injection of unsanitised HTML into editable fields managed by TinyMCE. An authenticated attacker with low privileges can embed HTML that is stored in the database and subsequently rendered in other users’ browsers, altering the visual presentation of application content. This stored cross‑site scripting could be used to deceive users or inject misleading information within the interface.

The affected system is Coupa’s Total Spend Management Platform, as identified by the vendor Coupa. No specific version information is provided in the CNA data.

The CVSS score of 5.1 indicates a medium severity level, and the EPSS score is not available, making it difficult to assess current exploitation likelihood. The vulnerability is not included in the CISA KEV catalog. Based on the description, the attack vector is inter‑application and requires authenticated access with low privileges; an attacker must add or edit content within the platform, and the malicious content is then displayed when other users view the affected pages. The risk is moderate, with potential for phishing and UI hijacking but limited to users who access the modified content.