CVE-2026-47762High· 8.7▾ TwilightTinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.
tinymce < 5.11.1tinymce >= 6.0.0, < 7.9.3tinymce >= 8.0.0, < 8.5.1Upgrade past the affected range:
tinymce 8.5.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-47761High· 8.7TinyMCE is an open source rich text editor
CVE-2026-47759High· 8.7TinyMCE is an open source rich text editor
CVE-2024-21911Medium· 6.1TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability
CVE-2024-21908Medium· 6.1TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability
CVE-2026-47760High· 8.7TinyMCE is an open source rich text editor
CVE-2024-38357Medium· 6.1TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements