Arbitrary Script Injection Vulnerability in TinyMCE Plugin for WordPress

CVE-2024-8627

What is CVE-2024-8627?

The Ultimate TinyMCE plugin for WordPress presents a vulnerability that allows stored cross-site scripting (XSS) via the 'field' shortcode. This issue arises from insufficient input sanitization and output escaping, enabling authenticated users with Contributor-level access or higher to inject malicious web scripts into pages. When other users access these compromised pages, the injected scripts execute, potentially compromising user data and site integrity. It is crucial for site administrators to update the plugin to mitigate this risk.

References