Medium · 4.3 CVE-2024-25904 EUVD-2024-23206GHSA-r59f-4p8m-j64c

WordPress TinyMCE Professional Formats and Styles Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Published Feb 21, 2024 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: David Stockl Product: TinyMCE and TinyMCE Advanced Professsional Formats and Styles

Description

Cross-Site Request Forgery (CSRF) vulnerability in David Stockl TinyMCE and TinyMCE Advanced Professsional Formats and Styles.This issue affects TinyMCE and TinyMCE Advanced Professsional Formats and Styles: from n/a through 1.1.2.

Affected products

Vendor	Product	Affected	Fixed
David Stockl	TinyMCE and TinyMCE Advanced Professsional Formats and Styles	≤ 1.1.2	—

References

https://patchstack.com/database/vulnerability/tinymce-and-tinymce-advanced-professsional-formats-and-styles/wordpress-tinymce-and-tinymce-advanced-professsional-formats-and-styles-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry