Ph5I

**Name of the Vulnerable Software and Affected Versions** TinyMCE versions prior to 5.10.8 TinyMCE versions prior to 6.7.1 **Description** A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions for this exploit require carefully crafted malicious content to have been inserted into the editor and a notification to have been triggered. When a notification was opened, the HTML within the text argument was displayed unfiltered in the notification. The vulnerability allowed arbitrary JavaScript execution when a notification was presented in the TinyMCE UI for the current user. This issue could also be exploited by any integration that uses a TinyMCE notification to display unfiltered HTML content. **Recommendations** * Upgrade to TinyMCE 5.10.8 or higher for TinyMCE 5.x. * Upgrade to TinyMCE 6.7.1 or higher for TinyMCE 6.x.