Secalert

The media plugin allows the creation of elements via the `data-mce-object` attribute in the active document before sanitization occurs. This flaw enables the execution of malicious scripts, leading to stored cross-site scripting (XSS), which is a technique where a script is permanently stored on a target server and executed in the browser of a user visiting the affected page.

The issue allows a malicious user to trigger remote code execution by crafting the value for the `response type` parameter, which is executed as Spring SpEL when processing authorization requests using the whitelabel views.