A high-severity flaw has been disclosed in TinyMCE, an open-source text editor used in content management systems (CMS) of websites. Researchers found a built-in cross-site scripting (XSS) flaw that could have been potentially exploited remotely by attackers to gain administrative privileges to websites. Tiny Technologies’ Tiny Technologies says millions of people use the editor daily, however researchers that found the flaw estimate only thousands of website CMS tools are impacted. The flaw exists in version 5.2.0 and earlier of the TinymCE application.
Source: https://threatpost.com/high-severity-tinymce-cross-site-scripting-flaw-fixed/158306/