---
title: tinyMCE – XSS Vulnerability On Versions Between 5.0.0 And 5.1.4, On The Core Parser, Paste And visualcharts Plugins
description: "**Impact area** Security **Severity** High **Affected element** **ServiceNow** UI Script **Salesforce** Static Resource ## Rule number **SN-JSL-TINYMCE-BETWEEN-V500-V514(**for ServiceNow) **SF-JSL-TINYMCE-BETWEEN-V500-V514**(for Salesforce) ## Impact The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via…"
url: "https://community-staging.qualityclouds.com/qcdocs/qcr/rules/tinymce-xss-vulnerability-on-versions-between-5-0-0-and-5-1-4-on-the-core-parser-paste-and-visualcharts-plugins/"
updated: "2025-03-21"
category: Rules
---

# tinyMCE – XSS Vulnerability On Versions Between 5.0.0 And 5.1.4, On The Core Parser, Paste And visualcharts Plugins

**Impact area**

Security

**Severity**

High

**Affected element**

**ServiceNow**

UI Script

**Salesforce**

Static Resource

## Rule number

**SN-JSL-TINYMCE-BETWEEN-V500-V514(**for ServiceNow)

**SF-JSL-TINYMCE-BETWEEN-V500-V514**(for Salesforce)

## Impact

The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs.

## Remediation

Update tinyMCE to the latest version.

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').](https://cwe.mitre.org/data/definitions/79.html)