CVE-2026-47761

HIGH

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

Title source: cna
STIX 2.1

Description

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

References (3)

Core 3

Scores

CVSS v3 8.7
EPSS 0.0020
EPSS Percentile 9.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-79
Status published
Products (14)
npm/tinymce 0npm
npm/tinymce 6.0.0 - 7.9.3npm
npm/tinymce 8.0.0 - 8.5.1npm
nuget/TinyMCE 0NuGet
nuget/TinyMCE 6.0.0 - 7.9.3NuGet
nuget/TinyMCE 8.0.0 - 8.5.1NuGet
tiny/tinymce < 5.11.1
tinymce/tinymce 0Packagist
tinymce/tinymce 6.0.0 - 7.9.3Packagist
tinymce/tinymce 8.0.0 - 8.5.1Packagist
... and 4 more
Published May 28, 2026
Tracked Since May 28, 2026