This vulnerability is a CSRF issue in TinyMCE and TinyMCE Advanced Professional Formats and Styles maintained by David Stockl, affecting versions up to 1.1.2. It allows attackers to trick authenticated users into submitting unintended requests, potentially causing limited unauthorized modifications. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but requires user interaction. The impact is limited to integrity with no confidentiality or availability impact. No vendor patch or official remediation level is currently documented.

The impact is limited to integrity as the vulnerability could allow an attacker to cause a user to perform unintended actions within the affected software. There is no impact on confidentiality or availability. The medium severity rating reflects the limited scope and requirement for user interaction. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens in requests or restricting actions to trusted origins where possible. Monitor vendor communications for updates on patches or official mitigations.