CVE-2023-54423: OpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG Editor
OpenMage · magento-lts
Fixed in 20.2.0 · Affected: OpenMage magento-lts before 20.2.0 · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
No EPSS score yet. The score appears once FIRST publishes it.
DescriptionCVE.org
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- OpenMage · magento-ltsbefore 20.2.0
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Weakness
- Improper Neutralization of Script in Attributes of IMG Tags in a Web Page · Cross-site Scripting
- Vendor
- OpenMage
- Published
- November 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2023-54423 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.