This vulnerability involves persistent HTML injection in editable fields managed by TinyMCE within the platform. An authenticated user with low privileges can inject unsanitized HTML content that is stored in the database and later rendered in other users' browsers, potentially altering the display of content within the application.