CVE-2023-54423
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content.