TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows att…

TinyMCE, an open source rich text editor, contains a stored cross-site scripting (XSS) vulnerability in versions prior to 5.11.1, 7.9.3, and 8.5.1. The vulnerability exists via forged mce:protected comments that allow attackers to bypass sanitization mechanisms. Malicious scripts can be injected and will execute when content is restored. The vulnerability specifically impacts users who utilize the protect option in TinyMCE. Security patches are available in versions 5.11.1, 7.9.3, and 8.5.1 to address this issue.