Is CVE-2024-21910 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-21910 being exploited in the wild.

How severe is CVE-2024-21910?

Low severity, with a CVSS score of 3.1, published 2 July 2026.

Which products and versions are affected?

tinymce (npm) SEMVER:introduced=0,fixed=5.10.0; django-tinymce (PyPI) ECOSYSTEM:introduced=0,fixed=3.4.0.

Is there a fix for CVE-2024-21910?

Yes. tinymce (npm): upgrade to 5.10.0 or later; django-tinymce (PyPI): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-21910 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-21910?

Check whether you run tinymce (npm) or django-tinymce (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-21910: PYSEC-2026-632 - Cross-site scripting vulnerability in TinyMCE plugins

CVE-2024-21910 · Severity: low · CVSS 3.1 · Published 2026-07-02

TinyMCE is a popular rich-text editor embedded in web applications and content management systems. A cross-site scripting (XSS) vulnerability in its image and link plugins allowed attackers to inject malicious JavaScript code when crafting specially-formed URLs. While the dangerous URLs were stripped from saved content, the vulnerability exposed users during the editing session, potentially allowing attackers to steal session tokens, modify content, or perform actions on behalf of the editor.

Technologies: tinymce (npm), django-tinymce (PyPI). Vendors: npm, PyPI.

Quick answers

Is CVE-2024-21910 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-21910 being exploited in the wild.
How severe is CVE-2024-21910?: Low severity, with a CVSS score of 3.1, published 2 July 2026.
Which products and versions are affected?: tinymce (npm) SEMVER:introduced=0,fixed=5.10.0; django-tinymce (PyPI) ECOSYSTEM:introduced=0,fixed=3.4.0.
Is there a fix for CVE-2024-21910?: Yes. tinymce (npm): upgrade to 5.10.0 or later; django-tinymce (PyPI): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-21910 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-21910?: Check whether you run tinymce (npm) or django-tinymce (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tinymce (npm): upgrade to 5.10.0 or later
```
npm install tinymce@5.10.0
```
django-tinymce (PyPI): upgrade to 3.4.0 or later
```
pip install "django-tinymce>=3.4.0"
```

Technical details

The vulnerability is a reflected/stored cross-site scripting (CWE-79) flaw in the URL processing logic of TinyMCE's image and link plugins. When a user updates an image or link element using a specially-crafted URL containing JavaScript payloads, the plugins fail to properly sanitize the input before rendering it in the editor interface. The attack requires user interaction (a user must attempt to edit an image or link with a malicious URL), and affects all versions prior to 5.10.0. The fix, released in TinyMCE 5.10.0, improved sanitization logic when processing and displaying URLs in these plugins. Note: dangerous URLs are stripped from content saved to the database, limiting persistence.

Affected products

Tiny Technologies TinyMCE < 5.10.0
jazzband django-tinymce < 3.4.0

Identifiers

CVE-2024-21910
GHSA-r8hm-w5f7-wj39
PYSEC-2026-632

Timeline

2021-11-02: disclosed: Advisory published
2021-11-01: patched: Fix released in TinyMCE 5.10.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.