CVE-2026-47762: TinyMCE Cross-Site Scripting (XSS) Vulnerability via mce:protected Comments
Summary
CVE-2026-47762: TinyMCE Cross-Site Scripting (XSS) vulnerability through mce:protected comments. Affects tinymce across 2 version ranges.
>= 6.0.0, < 7.9.3
>= 8.0.0, < 8.5.1
Fixed in 7.9.3 or 8.5.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TinyMCE is a popular open-source rich text editor that enables users to create and edit content in a web-based environment. It is widely utilized in various applications for its flexibility and ease of integration. However, it has been found to be vulnerable to a stored Cross-Site Scripting (XSS) attack through the use of forged mce:protected comments, which can compromise user data and application security.
Vulnerability Detail
The vulnerability arises from the improper sanitization of mce:protected comments, allowing attackers to inject malicious scripts that execute when the content is restored. This poses a significant risk to users who utilize the protect option, as it can lead to unauthorized access to sensitive information and manipulation of the application’s behavior.
How To Fix
Latest published version: 8.10.0 as of 23 Oct 2026
npm install tinymce@8.10.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 7.9.37.9.3npm install tinymce@7.9.3 -
>= 8.0.0, < 8.5.18.5.1npm install tinymce@8.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No official workaround is available for this vulnerability. The recommended action is to upgrade to the patched versions as mentioned above.
Conclusion
The TinyMCE vulnerability CVE-2026-47762 poses a significant risk through stored XSS attacks via forged mce:protected comments. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for tinymce →
FAQ
The vulnerability is a stored Cross-Site Scripting (XSS) issue that allows attackers to inject malicious scripts through forged mce:protected comments.
Users of TinyMCE who utilize the protect option are at risk of this vulnerability.
If exploited, this vulnerability can lead to unauthorized access to user data and manipulation of the application, potentially compromising security.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for tinymce.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
