CVE-2026-47759: TinyMCE Cross-Site Scripting (XSS) Vulnerability via data-mce-* Attributes
Summary
CVE-2026-47759: Impact Stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Affects tinymce across 2 version ranges.
>= 6.0.0, < 7.9.3
>= 8.0.0, < 8.5.1
Fixed in 7.9.3 or 8.5.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinyMCE is a popular open-source rich text editor that enables users to create and edit content in a web-based environment. It is widely used due to its flexibility, ease of integration, and extensive features such as customizable toolbars, plugins, and support for various content formats. However, TinyMCE has a vulnerability that allows attackers to exploit unsanitized data-mce-* attributes, leading to potential Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the ability to inject malicious values into unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style) within TinyMCE. This allows attackers to override safe attributes during serialization, effectively bypassing validation mechanisms. The ramifications include the potential for attackers to execute arbitrary scripts in the context of the user's browser, leading to data theft, session hijacking, or other malicious activities.
How To Fix
Latest published version: 8.10.0 as of 23 Oct 2026
npm install tinymce@8.10.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 7.9.37.9.3npm install tinymce@7.9.3 -
>= 8.0.0, < 8.5.18.5.1npm install tinymce@8.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no official workarounds available for this vulnerability. It is strongly recommended to upgrade to the patched versions as soon as possible.
Conclusion
The CVE-2026-47759 vulnerability in TinyMCE highlights a significant security risk due to unsanitized data-mce-* attributes that can lead to XSS attacks. Users are urged to upgrade to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for tinymce →
FAQ
CVE-2026-47759 is a vulnerability in TinyMCE that allows for Cross-Site Scripting (XSS) attacks through unsanitized data-mce-* attributes.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
The vulnerability can lead to data theft, session hijacking, and execution of arbitrary scripts in the user's browser, posing serious security risks.
Yes, patches are available in the latest versions of TinyMCE. Users should upgrade to TinyMCE 8.5.1, 7.9.3, or 5.11.1 LTS or higher.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for tinymce.
