CVE-2026-47761High· 8.7▾ MidnightPoC availableTinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when con…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
1 GitHub repo (last check)
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.
tinymce < 5.11.1tinymce >= 6.0.0, < 7.9.3tinymce >= 8.0.0, < 8.5.1Upgrade past the affected range:
tinymce 8.5.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-47762High· 8.7TinyMCE is an open source rich text editor
CVE-2026-47759High· 8.7TinyMCE is an open source rich text editor
CVE-2024-21911Medium· 6.1TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability
CVE-2024-21908Medium· 6.1TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability
CVE-2026-47760High· 8.7TinyMCE is an open source rich text editor
CVE-2021-41184Medium· 6.5jQuery-UI is the official jQuery user interface library