CVE-2025-62871

Name of the Vulnerable Software and Affected Versions Just TinyMCE Custom Styles versions prior to 1.2.2

Description Just TinyMCE Custom Styles is subject to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation—a security mechanism used to ensure that a request was intentionally sent by the user—within a function. Unauthenticated attackers can execute unauthorized actions by tricking a site administrator into clicking a malicious link.

Recommendations Update Just TinyMCE Custom Styles to version 1.2.2 or later.