CVE-2026-116675High· 8.5▾ TwilightTinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malic…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.
tinymce >= 8.5.1, < 8.9.3tinymce >= 7.9.3, < 7.9.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-21911Medium· 6.1TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability
CVE-2024-21908Medium· 6.1TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability
CVE-2026-47761High· 8.7TinyMCE is an open source rich text editor
CVE-2026-47762High· 8.7TinyMCE is an open source rich text editor
CVE-2026-47759High· 8.7TinyMCE is an open source rich text editor
CVE-2026-47760High· 8.7TinyMCE is an open source rich text editor