← Database

CVE-2026-47761

HIGH CVSS: 8.7 Published: 2026-05-28 Modified: 2026-06-17

Description

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

Affected Platforms

Tiny Tinymce

Weakness Type

CWE-79

References