TinyMCE rich text editor contains a stored XSS vulnerability in versions prior to 5.11.1, 7.9.3, and 8.5.1. The vulnerability exists in unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style) that allow attackers to inject malicious values. These malicious values can override safe attributes during serialization, effectively bypassing validation mechanisms. The vulnerability has been patched in the specified versions across all affected TinyMCE release branches.