The issue concerns the bbcode plugin in TinyMCE, which fails to properly enforce the security policy. This specifically affects the encoding directive and the valid elements attribute, allowing for cross-site scripting (XSS) attacks. An example of exploitation involves using a textarea element.