title: Cross-site scripting vulnerability in TinyMCE plugins
description: TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser.
problem types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')