GHSA-wqm8-jx8r-8rcq
Cross-site scripting vulnerabilities in old version of bundled TinyMCE
GHSA-wqm8-jx8r-8rcq is a medium vulnerability (CVSS 5.4) in silverstripe/admin, published April 26, 2023. No source lists public exploit code. Fixed in silverstripe/admin 1.12.7.
- Severity
- 5.4 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.12.7silverstripe/admin +1 more
Description
An old version of TinyMCE include an XSS vulnerability, which was patched in a later version. This was described by TinyMCE:
A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.
We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS.
Reported by: Developers at ACC
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/adminPackagist | before 1.12.7 | 1.12.7 |
silverstripe/adminPackagist | before 1.12.7, plus listed versions 1.0.01.0.0-alpha61.0.0-alpha71.0.0-beta11.0.0-beta2 Show 45 moreShow less1.0.0-beta31.0.0-beta41.0.0-rc11.0.0-rc21.0.0-rc31.0.11.0.1-rc11.0.21.0.31.0.41.0.51.0.61.0.71.1.01.1.0-rc11.1.0-rc21.1.11.1.21.1.31.1.41.1.51.10.01.10.0-beta11.10.0-rc11.10.11.10.21.10.31.10.41.11.01.11.0-beta11.11.0-rc11.11.11.11.21.11.31.12.01.12.0-beta11.12.0-rc11.12.11.12.21.12.31.12.41.12.51.12.61.2.01.2.0-beta1 | 1.12.7 |
What each source reports
GitHub Advisories Score used
Cross-site scripting vulnerabilities in old version of bundled TinyMCE
An old version of TinyMCE include an XSS vulnerability, which was patched in a later version. This was described by TinyMCE:
A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.
We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS.
Reported by: Developers at ACC
- Record
GHSA-wqm8-jx8r-8rcq- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSV
Cross-site scripting vulnerabilities in old version of bundled TinyMCE
An old version of TinyMCE include an XSS vulnerability, which was patched in a later version. This was described by TinyMCE:
A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.
We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS.
Reported by: Developers at ACC
- Record
GHSA-wqm8-jx8r-8rcq- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/silverstripe/silverstripe-admin/security/advisories/GHSA-wqm8-jx8r-8rcq
silverstripe.org/download/security-releases/ss-2023-001
tiny.cloud/docs/release-notes/release-notes54
Left out here: 48 versions. The JSON record has them.