CVE-2026-116675
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
TinyMCE versions 7.9.3 through 7.9.4 and 8.5.1 through 8.9.3 contain a stored XSS vulnerability in the media plugin. Elements crafted via data-mce-object can execute malicious scripts during processing before sanitization. The issue is fixed in 8.9.3 and 7.9.4.
Risk Assessment
Users with the media plugin enabled could be targeted by XSS, leading to session theft or actions performed on their behalf. The risk affects applications using vulnerable editor versions.
Recommendation
Update TinyMCE to version 8.9.3 or 7.9.4 (or later). Until patched, disable the media plugin or restrict user content insertion.
Other vulnerabilities in TinyMCE
See all- CVE-2026-47762High
TinyMCE is an open source rich text editor that prior to versions 5.11.1, 7.9.3, and 8.5.1 had a stored XSS vulnerability via forged mce:protected comments. This allows attackers to bypass sanitization and inject scripts that execute when content is restored.
- CVE-2026-47760High
TinyMCE is an open source rich text editor that from versions 6.8.0 to before 7.1.0 contains an XSS vulnerability due to improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript.
- CVE-2026-47759High
TinyMCE is an open source rich text editor that prior to versions 5.11.1, 7.9.3, and 8.5.1 had a stored XSS vulnerability via unsanitized data-mce-* attributes. This allows attackers to inject malicious values that can override safe attributes during serialization.
- CVE-2024-21911Medium
Stored XSS vulnerability in TinyMCE before version 5.6.0. An unauthenticated remote attacker can inject crafted HTML into the editor, leading to arbitrary JavaScript execution in another user's browser.
- CVE-2024-21910Medium
An XSS vulnerability in TinyMCE before version 5.10.0 allows a remote, unauthenticated attacker to inject malicious JavaScript via crafted image or link URLs. The code executes in the browser of a user editing content.
- CVE-2024-21908Medium
Stored XSS vulnerability in TinyMCE before version 5.9.0. An unauthenticated remote attacker can inject crafted HTML into the editor, leading to arbitrary JavaScript execution in another user's browser.
Original NVD description (English source)
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS