TinyMCE, an open source rich text editor, contains a stored cross-site scripting (XSS) vulnerability in versions prior to 5.11.1, 7.9.3, and 8.5.1. The vulnerability exists via forged mce:protected comments that allow attackers to bypass sanitization mechanisms. Malicious scripts can be injected and will execute when content is restored. The vulnerability specifically impacts users who utilize the protect option in TinyMCE. Security patches are available in versions 5.11.1, 7.9.3, and 8.5.1 to address this issue.