Vulnerability · Published May 28, 2026 · Assigned by GitHub_M

CVE-2026-47760TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

High 8.7

In plain English

A high-severity cross-site scripting in tinymce from tinymce. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.2%top 91.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	tinymce	7.1.0	GHSA-mh5m-5hw4-5c69
Packagist	tinymce/tinymce	7.1.0	GHSA-mh5m-5hw4-5c69
npm	tinymce	7.1.0	GHSA-mh5m-5hw4-5c69

Affected products (as reported)

Vendor	Product	Versions
tinymce	tinymce	>= 6.0.0, < 7.1.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

https://github.com/tinymce/tinymce/security/advisories/GHSA-mh5m-5hw4-5c69 x_refsource_CONFIRM