TinyMCE rich text editor contains a stored cross-site scripting (XSS) vulnerability in its media plugin affecting versions prior to 5.11.1, 7.9.3, and 8.5.1. Attackers can inject malicious scripts through crafted data-mce-* attributes that execute when content is rendered. The vulnerability impacts all users who have the media plugin enabled. Fixes are available in the specified updated versions across all affected release branches.