Log in Start free

Vulnerability · Published May 28, 2026 · Assigned by GitHub_M

CVE-2026-47762TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

High 8.7

In plain English

A high-severity cross-site scripting in tinymce from tinymce. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.7High
Exploit odds (30 days)0.3%top 79.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
NuGettinymceno fix listedGHSA-v98h-vmpc-fpqv
NuGettinymce8.5.1GHSA-v98h-vmpc-fpqv
NuGettinymce7.9.3GHSA-v98h-vmpc-fpqv
Packagisttinymce/tinymce8.5.1GHSA-v98h-vmpc-fpqv
Packagisttinymce/tinymceno fix listedGHSA-v98h-vmpc-fpqv
Packagisttinymce/tinymce7.9.3GHSA-v98h-vmpc-fpqv
npmtinymceno fix listedGHSA-v98h-vmpc-fpqv
npmtinymce8.5.1GHSA-v98h-vmpc-fpqv
npmtinymce7.9.3GHSA-v98h-vmpc-fpqv

Affected products (as reported)

VendorProductVersions
tinymce tinymce < 5.11.1>= 6.0.0, <= 6.8.6>= 7.0.0, < 7.9.3>= 8.0.0, < 8.5.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References