CVE-2023-54423
OpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG Editor
CVE-2023-54423 is a high vulnerability (CVSS 8.3) in Openmage Magento-lts, published December 8, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in openmage/magento-lts 20.2.0.
- Severity
- 8.3 HighCVSS 4.0, CVE List
- Exploit chance
- 0.25%EPSS, 16th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
20.2.0openmage/magento-lts +1 more
Description
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openmage/magento-ltsPackagist | before 20.2.0 | 20.2.0 |
openmage/magento-ltsPackagist | before 20.2.0, plus listed versions 1.9.1.11.9.2.01.9.2.11.9.2.21.9.2.3 Show 45 moreShow less1.9.2.41.9.3.01.9.3.1v19.4.0v19.4.1v19.4.10v19.4.11v19.4.12v19.4.13v19.4.14v19.4.15v19.4.16v19.4.17v19.4.18v19.4.19v19.4.2v19.4.20v19.4.21v19.4.22v19.4.23v19.4.3v19.4.4v19.4.5v19.4.6v19.4.7v19.4.8v19.4.9v19.5.0v19.5.0-rc1v19.5.0-rc2v19.5.0-rc3v19.5.0-rc4v19.5.0-rc5v19.5.1v19.5.2v19.5.3v20.0.0v20.0.1v20.0.10v20.0.11v20.0.12v20.0.13v20.0.14v20.0.15v20.0.16 | 20.2.0 |
What each source reports
CVE List Score used
OpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG Editor
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content.
- Record
CVE-2023-54423- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-82
- Updated
- 2026-11-13
EUVDEUVD-2023-60729
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content.
- Record
EUVD-2023-60729- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L - Updated
- 2026-11-13
GitHub AdvisoriesGHSA-9j5w-2cqc-cwj9
Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor
From HackerOne report #1948040 by Halit AKAYDIN (hltakydn)
Impact
What kind of vulnerability is it? Who is impacted?
The TinyMCE WYSIWYG editor fails to filter scripts when rendering the HTML in specially crafted HTML tags.
Patches
Has the problem been patched? What versions should users upgrade to?
This vulnerability was fixed in version 20.2.0 by upgrading TinyMCE to a recent version in https://github.com/OpenMage/magento-lts/pull/3220
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
The WYSIWYG editor features could be disabled in the configuration. Possibly some WAF appliances would filter this attack.
References
Are there any links users can visit to find out more?
The attack is simply an exploit of the "onmouseover" attribute of an img element as described on OWASP XSS Filter Evasion
- Record
GHSA-9j5w-2cqc-cwj9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xcf8-w9c3-m6r5
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because...
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content.
- Record
GHSA-xcf8-w9c3-m6r5- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-82
- Updated
- 2026-11-13
NVD
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content.
- Record
CVE-2023-54423- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-82
- Updated
- 2026-11-13
OSV
OpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG Editor
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content.
- Record
CVE-2023-54423- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L - Weakness
- CWE-82
- Updated
- 2026-11-14
OSVGHSA-9j5w-2cqc-cwj9
Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor
From HackerOne report #1948040 by Halit AKAYDIN (hltakydn)
Impact
What kind of vulnerability is it? Who is impacted?
The TinyMCE WYSIWYG editor fails to filter scripts when rendering the HTML in specially crafted HTML tags.
Patches
Has the problem been patched? What versions should users upgrade to?
This vulnerability was fixed in version 20.2.0 by upgrading TinyMCE to a recent version in https://github.com/OpenMage/magento-lts/pull/3220
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
The WYSIWYG editor features could be disabled in the configuration. Possibly some WAF appliances would filter this attack.
References
Are there any links users can visit to find out more?
The attack is simply an exploit of the "onmouseover" attribute of an img element as described on OWASP XSS Filter Evasion
- Record
GHSA-9j5w-2cqc-cwj9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-14
History
| Recorded | Changed | Sources |
|---|---|---|
| references | OSV | |
| affected, aliases, cwes, facts, published, references | OSV | |
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories, NVD | |
| aliases, published | EUVD | |
| first indexed | CVE List | |
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/OpenMage/magento-lts/security/advisories/GHSA-9j5w-2cqc-cwj9
vulncheck.com/advisories/openmage-magento-lts-before-20.2.0-stored-xss-via-tinymce-wysiwyg-editor
hackerone.com/reports/1948040
Left out here: 20 versions. The JSON record has them.