# CVE-2024-21910: PYSEC-2026-632 - Cross-site scripting vulnerability in TinyMCE plugins

Source: https://junglewise.ai/threats/cve-2024-21910-tinymce-cross-site-scripting-in-image-and-link-plugins  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-21910 · Severity: low · CVSS 3.1 · Published 2026-07-02

TinyMCE is a popular rich-text editor embedded in web applications and content management systems. A cross-site scripting (XSS) vulnerability in its image and link plugins allowed attackers to inject malicious JavaScript code when crafting specially-formed URLs. While the dangerous URLs were stripped from saved content, the vulnerability exposed users during the editing session, potentially allowing attackers to steal session tokens, modify content, or perform actions on behalf of the editor.

Technologies: [tinymce (npm)](https://junglewise.ai/threats/technologies/tinymce), [django-tinymce (PyPI)](https://junglewise.ai/threats/technologies/django-tinymce). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-21910 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-21910 being exploited in the wild.

**How severe is CVE-2024-21910?** Low severity, with a CVSS score of 3.1, published 2 July 2026.

**Which products and versions are affected?** tinymce (npm) SEMVER:introduced=0,fixed=5.10.0; django-tinymce (PyPI) ECOSYSTEM:introduced=0,fixed=3.4.0.

**Is there a fix for CVE-2024-21910?** Yes. tinymce (npm): upgrade to 5.10.0 or later; django-tinymce (PyPI): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-21910 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-21910?** Check whether you run tinymce (npm) or django-tinymce (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tinymce (npm): upgrade to 5.10.0 or later

  ```sh
  npm install tinymce@5.10.0
  ```

- django-tinymce (PyPI): upgrade to 3.4.0 or later

  ```sh
  pip install "django-tinymce>=3.4.0"
  ```


## Technical details

The vulnerability is a reflected/stored cross-site scripting (CWE-79) flaw in the URL processing logic of TinyMCE's image and link plugins. When a user updates an image or link element using a specially-crafted URL containing JavaScript payloads, the plugins fail to properly sanitize the input before rendering it in the editor interface. The attack requires user interaction (a user must attempt to edit an image or link with a malicious URL), and affects all versions prior to 5.10.0. The fix, released in TinyMCE 5.10.0, improved sanitization logic when processing and displaying URLs in these plugins. Note: dangerous URLs are stripped from content saved to the database, limiting persistence.

## Affected products

- Tiny Technologies TinyMCE < 5.10.0
- jazzband django-tinymce < 3.4.0

## Identifiers

- CVE-2024-21910
- GHSA-r8hm-w5f7-wj39
- PYSEC-2026-632

## Timeline

- 2021-11-02: disclosed: Advisory published
- 2021-11-01: patched: Fix released in TinyMCE 5.10.0

## References

- [https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39](https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39)
- [https://github.com/jazzband/django-tinymce/issues/366](https://github.com/jazzband/django-tinymce/issues/366)

## Related threats

- [TinyMCE media plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116675-tinymce-is-an-open-source-rich-text-editor-from-7-9-3-until-7-9)
- [PYSEC-2026-1301 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option](https://junglewise.ai/threats/cve-2024-38356-tinymce-cross-site-scripting-in-noneditable-regexp)
- [PYSEC-2026-1302 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements](https://junglewise.ai/threats/cve-2024-38357-tinymce-cross-site-scripting-in-noscript-element-parsing)
- [Tiny Technologies TinyMCE stored XSS via forged mce:protected comments](https://junglewise.ai/threats/cve-2026-47762-tiny-technologies-tinymce-stored-xss-via-forged-mce-protected)
- [Tiny Technologies TinyMCE stored XSS in media plugin](https://junglewise.ai/threats/cve-2026-47761-tiny-technologies-tinymce-stored-xss-in-media-plugin)