CVE-2024-21911 is a stored cross-site scripting vulnerability affecting TinyMCE versions prior to 5.6.0. The vulnerability arises from improper neutralization of input during web page generation, allowing an unauthenticated remote attacker to insert malicious HTML into the editor. When other users load the affected content, the injected JavaScript executes in their browsers, potentially compromising confidentiality and integrity. The CVSS vector indicates the attack requires no privileges and low attack complexity but requires user interaction. The vulnerability impacts confidentiality and integrity but not availability.

An attacker can remotely and without authentication inject malicious HTML/JavaScript into the TinyMCE editor content. This results in arbitrary script execution in the browsers of users who view the compromised content, potentially leading to data theft, session hijacking, or other client-side attacks. The impact affects confidentiality and integrity but does not affect system availability.

Upgrade TinyMCE to version 5.6.0 or later, where this vulnerability is fixed. Since the vulnerability affects versions before 5.6.0, applying this official fix will remediate the issue. No vendor advisory was provided, so patch status is inferred from the version information in the description.