---
id: CVE-2026-47762
title: TinyMCE is an open source rich text editor
summary: >-
  TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1,
  there is a stored XSS vulnerability via forged mce:protected comments. Allows
  attackers to bypass sanitization and inject scripts that execute when content
  is…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
vendor: tiny
product: tinymce
affected:
  - tinymce < 5.11.1
  - 'tinymce >= 6.0.0, < 7.9.3'
  - 'tinymce >= 8.0.0, < 8.5.1'
patched:
  - tinymce 8.5.1
published: '2026-05-28'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47762'
references:
  - url: 'https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv'
    label: security-advisories@github.com
  - url: 'https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview'
    label: security-advisories@github.com
  - url: 'https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00416
epssPercentile: 0.3434
ingestedAt: '2026-10-14T20:53:12.338Z'
---

## Overview

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

## Affected

- `tinymce < 5.11.1`
- `tinymce >= 6.0.0, < 7.9.3`
- `tinymce >= 8.0.0, < 8.5.1`

## Remediation

Upgrade past the affected range:

- `tinymce 8.5.1`