CVE-2026-47760-nvd.nist.gov-Received

TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in…

Published:

27 May 2026 at 22:00:00

Alert date:

28 May 2026 at 17:06:19

Source:

nvd.nist.gov

Web Technologies

TinyMCE rich text editor versions 6.8.0 to before 7.1.0 contain a Cross-Site Scripting (XSS) vulnerability. The vulnerability is caused by improper SVG namespace scope handling in the sanitizer component. Attackers can craft malicious payloads using nested SVG elements to bypass attribute sanitization mechanisms. This allows execution of arbitrary JavaScript code in the context of the application. The vulnerability has been patched in version 7.1.0 of TinyMCE.

Technical details

Mitigation steps:

Affected products:

TinyMCE