CVE-2024-21911 is a stored cross-site scripting vulnerability affecting TinyMCE versions prior to 5.6.0. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker without authentication to insert malicious HTML content into the editor. When other users load the affected content, the injected JavaScript executes in their browsers, potentially compromising their session or data. The vulnerability has a CVSS 3.1 base score of 6.1, with attack vector network, low attack complexity, no privileges required, and user interaction required. The impact includes limited confidentiality and integrity loss but no availability impact.

An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of another user's browser session when they view the malicious content in TinyMCE. This can lead to theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity, with no direct availability impact reported.

A fix is available in TinyMCE version 5.6.0 and later. Users and administrators should upgrade to version 5.6.0 or newer to remediate this vulnerability. Since this is not a cloud service, patching the affected software is required to mitigate the risk. No vendor advisory content was provided to indicate alternative mitigations or that no action is required.