{"id":"CVE-2023-54423","kind":"vulnerability","aliases":["CVE-2023-54423"],"related":[],"title":"OpenMage magento-lts: stored XSS through TinyMCE editor lets scripts run","description":"OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content.","summary":"OpenMage magento-lts before 20.2.0 has a stored cross-site scripting flaw because the TinyMCE WYSIWYG editor does not filter scripts in crafted HTML tags. An attacker can inject an img element with a malicious onmouseover attribute that runs script in the browsers of users who view the rendered content.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["magento-lts","openmage","package","php","self-hosted"],"not_affected_if":["no-tinymce-wysiwyg","version-20.2.0-or-later"],"how_to_check":"- Check the installed magento-lts / OpenMage version and compare it with `20.2.0`\n- Review stored WYSIWYG content for img tags with onmouseover attributes\n- Confirm whether TinyMCE WYSIWYG editing is enabled for admin or content editors","fix":"- OpenMage magento-lts: move to `20.2.0` or later","status":"open","published_at":"2026-11-13T10:17:23+00:00","first_seen_at":"2026-11-13T10:47:09+00:00","triaged_at":"2026-11-13T10:51:17+00:00","updated_at":"2026-11-13T10:51:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:51:17Z","model":"claude-haiku-5-5","output":{"fix":"- OpenMage magento-lts: move to `20.2.0` or later","reach":"internet","title":"OpenMage magento-lts: stored XSS through TinyMCE editor lets scripts run","impact":"medium","summary":"OpenMage magento-lts before 20.2.0 has a stored cross-site scripting flaw because the TinyMCE WYSIWYG editor does not filter scripts in crafted HTML tags. An attacker can inject an img element with a malicious onmouseover attribute that runs script in the browsers of users who view the rendered content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["magento-lts","openmage","php","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in visitors' browsers, session data can be stolen","analyst_note":"Vendor advisory and VulnCheck advisory are linked but their text was not provided; confirm exact affected range and any workaround there.','product_name':","how_to_check":"- Check the installed magento-lts / OpenMage version and compare it with `20.2.0`\n- Review stored WYSIWYG content for img tags with onmouseover attributes\n- Confirm whether TinyMCE WYSIWYG editing is enabled for admin or content editors","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-20.2.0-or-later","no-tinymce-wysiwyg"],"who_is_affected":"Stores and sites running OpenMage magento-lts earlier than 20.2.0 that use the TinyMCE WYSIWYG editor to create or render content. Exposure comes from stored HTML that visitors' browsers render, so people who never use the editor are still exposed to content it stored. Installations on 20.2.0 or later are not affected by this flaw.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000794,"input_tokens":4622,"output_tokens":664,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2023':14A,17A '-54423':15A,18A '20.2.0':33B,85C 'attack':56B,108C 'attribut':66B,118C 'browser':72B,124C 'contain':86C 'content':79B,130C 'craft':52B,105C 'cross':38B,90C 'cross-sit':37B,89C 'cve':13A,16A 'editor':9A,46B,98C 'element':61B,113C 'execut':120C 'fail':99C 'filter':49B,101C 'flaw':41B 'host':27B 'html':53B,106C 'img':60B,112C 'inject':58B,110C 'let':10A 'lts':4A,21B,31B,83C 'magento':3A,20B,30B,82C 'magento-lt':2A,19B,29B,81C 'malici':64B,116C 'onmouseov':65B,117C 'openmag':1A,22B,28B,80C 'packag':23B 'php':24B 'render':78B,129C 'run':12A,68B 'script':11A,40B,50B,69B,92C,102C,121C 'self':26B 'self-host':25B 'site':39B,91C 'special':104C 'store':5A,36B,88C 'tag':54B,107C 'tinymc':8A,44B,96C 'user':74B,126C 'view':76B,127C 'vulner':93C 'wysiwyg':45B,97C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Stores and sites running OpenMage magento-lts earlier than 20.2.0 that use the TinyMCE WYSIWYG editor to create or render content. Exposure comes from stored HTML that visitors' browsers render, so people who never use the editor are still exposed to content it stored. Installations on 20.2.0 or later are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","magentolts","openmage","package","php","selfhosted"],"campaign_type":null,"search_a":"'-2023':14A,17A '-54423':15A,18A 'cve':13A,16A 'editor':9A 'let':10A 'lts':4A 'magento':3A 'magento-lt':2A 'openmag':1A 'run':12A 'script':11A 'store':5A 'tinymc':8A 'xss':6A","search_b":"'20.2.0':33B 'attack':56B 'attribut':66B 'browser':72B 'content':79B 'craft':52B 'cross':38B 'cross-sit':37B 'editor':46B 'element':61B 'filter':49B 'flaw':41B 'host':27B 'html':53B 'img':60B 'inject':58B 'lts':21B,31B 'magento':20B,30B 'magento-lt':19B,29B 'malici':64B 'onmouseov':65B 'openmag':22B,28B 'packag':23B 'php':24B 'render':78B 'run':68B 'script':40B,50B,69B 'self':26B 'self-host':25B 'site':39B 'store':36B 'tag':54B 'tinymc':44B 'user':74B 'view':76B 'wysiwyg':45B","search_c":"'20.2.0':85C 'attack':108C 'attribut':118C 'browser':124C 'contain':86C 'content':130C 'craft':105C 'cross':90C 'cross-sit':89C 'editor':98C 'element':113C 'execut':120C 'fail':99C 'filter':101C 'html':106C 'img':112C 'inject':110C 'lts':83C 'magento':82C 'magento-lt':81C 'malici':116C 'onmouseov':117C 'openmag':80C 'render':129C 'script':92C,102C,121C 'site':91C 'special':104C 'store':88C 'tag':107C 'tinymc':96C 'user':126C 'view':127C 'vulner':93C 'wysiwyg':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2023-12-08T01:22:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2023-54423","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54423","severity":null,"published_at":"2026-11-13T10:17:23+00:00","modified_at":"2026-11-13T10:17:23+00:00","first_seen_at":"2026-11-13T10:47:09+00:00","fetched_at":"2026-11-13T10:47:09+00:00","note":null}],"documents":[{"id":144840,"url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-9j5w-2cqc-cwj9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2023-12-08T01:22:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144841,"url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.2.0-stored-xss-via-tinymce-wysiwyg-editor","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}