A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script when configured in classic editing mode. The vulnerability is in the core parser and allows arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs.