A script element nested inside an SVG or MathML block can bypass Jodit's clean‑html "denyTags" filter because the filter does not normalize foreign tag names, allowing the script to remain in the editor value and execute when the page renders. The flaw is a DOM‑based XSS that could lead to theft of session cookies, site‑wide defacement, or the execution of arbitrary client‑side code in the context of users who load the compromised content. This vulnerability is categorized as CWE‑80.

The flaw exists in the Jodit WYSIWYG editor provided by the xdan vendor, affecting all versions earlier than 4.13.6. Users who embed or paste content that contains a <script> tag inside SVG or MathML structures are impacted.

With a CVSS score of 5.3 and an EPSS score below 1%, the vulnerability has moderate severity and a low probability of exploitation in the wild. It is not listed in CISA's KEV catalog. The likely attack vector is client‑side injection: an attacker can supply crafted content that a user loads into the editor, causing the client browser to execute the injected script when the content is rendered.