CVE-2026-47761-nvd.nist.gov-Received

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject mal…

Published:

27 May 2026 at 22:00:00

Alert date:

28 May 2026 at 17:06:19

Source:

nvd.nist.gov

Web Technologies

TinyMCE, an open source rich text editor, contains a stored XSS vulnerability in its media plugin affecting versions prior to 5.11.1, 7.9.3, and 8.5.1. Attackers can inject malicious scripts through crafted data-mce-* attributes that execute when content is rendered. The vulnerability impacts all users with the media plugin enabled. Patches are available in versions 5.11.1, 7.9.3, and 8.5.1.

Technical details

Mitigation steps:

Affected products:

TinyMCE