CVE-2026-47761CWE-79cross-site-scripting

CVE-2026-47761

High · published May 28, 2026

CVSS v3.1
8.7
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00264 · 17.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-28T20:16Z
Affected products (3)
ProductVersionsFixed in
tiny/tinymce< 5.11.15.11.1
tiny/tinymce≥ 6.0.0, < 7.9.37.9.3
tiny/tinymce≥ 8.0.0, < 8.5.18.5.1
References (3)
https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w · [email protected]https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview · [email protected]https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview · [email protected]
EPSS history
Timeline
  • 28 MAY 15:20Z
    TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
    cvelistv5