Log in Start free

Vulnerability · Published May 28, 2026 · Assigned by GitHub_M

CVE-2026-47759TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

High 8.7

In plain English

A high-severity cross-site scripting in tinymce from tinymce. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.7High
Exploit odds (30 days)0.3%top 79.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
NuGettinymceno fix listedGHSA-q742-qvgc-gc2f
NuGettinymce8.5.1GHSA-q742-qvgc-gc2f
NuGettinymce7.9.3GHSA-q742-qvgc-gc2f
Packagisttinymce/tinymce8.5.1GHSA-q742-qvgc-gc2f
Packagisttinymce/tinymceno fix listedGHSA-q742-qvgc-gc2f
Packagisttinymce/tinymce7.9.3GHSA-q742-qvgc-gc2f
npmtinymceno fix listedGHSA-q742-qvgc-gc2f
npmtinymce8.5.1GHSA-q742-qvgc-gc2f
npmtinymce7.9.3GHSA-q742-qvgc-gc2f

Affected products (as reported)

VendorProductVersions
tinymce tinymce < 5.11.1>= 6.0.0, <= 6.8.6>= 7.0.0, < 7.9.3>= 8.0.0, < 8.5.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References