Vendor
TinyMCE is vulnerable to stored Cross-Site Scripting (XSS) via the media plugin, allowing attackers to inject malicious scripts through the data-mce-object attribute before sanitization occurs.