---
title: "tinyMCE – XSS Vulnerability On Versions Under 4.7.12, In Links With XLINK:HREF Attributes"
description: "Impact Area Security       Severity High       Affected Element ServiceNow UI Script Salesforce Static Resource ## Rule number **SN-JSL-TINYMCE-LESSTHAN-V412 (**for ServiceNow) **SF-JSL-TINYMCE-LESSTHAN-V412 **(for Salesforce) ## Impact tinyMCE in versions before 4.7.12 allows XSS attacks through links with…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/vulnerabilities-in-open-source-libraries-salesforce/tinymce-xss-vulnerability-on-versions-under-4-7-12-in-links-with-xlinkhref-attributes/"
updated: "2025-03-21"
category: Rules
---

# tinyMCE – XSS Vulnerability On Versions Under 4.7.12, In Links With XLINK:HREF Attributes

Impact Area

Security

 

 

 

           Severity

High

 

 

 

           Affected Element

ServiceNow

UI Script

Salesforce

Static Resource

## Rule number

**SN-JSL-TINYMCE-LESSTHAN-V412 (**for ServiceNow)

**SF-JSL-TINYMCE-LESSTHAN-V412 **(for Salesforce)

## Impact

tinyMCE in versions before 4.7.12 allows XSS attacks through links with XLINK:HREF attributes.

## Remediation

Update tinyMCE to the latest version.

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’).](https://cwe.mitre.org/data/definitions/79.html)