TinyMCE, an open‑source rich text editor, is affected by a Cross‑Site Scripting flaw that arises from improper handling of the SVG namespace scope during sanitization. A crafted payload that nests SVG elements can bypass attribute sanitization and cause the editor to execute arbitrary JavaScript when the content is rendered in a browser. The vulnerability is present in releases between 6.8.0 and just before 7.1.0 and has been fixed in 7.1.0.

Any installation of TinyMCE with a version from 6.8.0 up to, but not including, 7.1.0 is vulnerable. The affected releases belong to the tinymce vendor of the open‑source rich‑text editor.

The CVSS score of 8.7 indicates high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the flaw by injecting malicious content into any editable field that uses TinyMCE, for example via user‑submitted posts or API data that is rendered in the editor. When the injected content is displayed, the JavaScript runs in the victim’s browser, giving the attacker the privileges of the viewer.