CVE-2026-47762: TinyMCE Cross-Site Scripting (XSS) Vulnerability via mce:protected Comments

tinymce Updated 05 Jun 2026

Summary

05/06/2026

Disclosed on

CVE-2026-47762

CVE

Yes i

Fix available

High

Severity

8.7

CVSS Score

CVE-2026-47762: TinyMCE Cross-Site Scripting (XSS) vulnerability through mce:protected comments. Affects tinymce across 2 version ranges.

>= 6.0.0, < 7.9.3 >= 8.0.0, < 8.5.1

Fixed in 7.9.3 or 8.5.1, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

TinyMCE is a popular open-source rich text editor that enables users to create and edit content in a web-based environment. It is widely utilized in various applications for its flexibility and ease of integration. However, it has been found to be vulnerable to a stored Cross-Site Scripting (XSS) attack through the use of forged mce:protected comments, which can compromise user data and application security.

Vulnerability Detail

The vulnerability arises from the improper sanitization of mce:protected comments, allowing attackers to inject malicious scripts that execute when the content is restored. This poses a significant risk to users who utilize the protect option, as it can lead to unauthorized access to sensitive information and manipulation of the application’s behavior.

How To Fix

Latest published version: 8.10.0 as of 23 Oct 2026

npm install tinymce@8.10.0

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 6.0.0, < 7.9.3 7.9.3
```
npm install tinymce@7.9.3
```
>= 8.0.0, < 8.5.1 8.5.1
```
npm install tinymce@8.5.1
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

No official workaround is available for this vulnerability. The recommended action is to upgrade to the patched versions as mentioned above.

Conclusion

The TinyMCE vulnerability CVE-2026-47762 poses a significant risk through stored XSS attacks via forged mce:protected comments. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk and ensure the security of their applications.

See every vulnerability recorded for tinymce →

FAQ

What is the nature of the vulnerability?

The vulnerability is a stored Cross-Site Scripting (XSS) issue that allows attackers to inject malicious scripts through forged mce:protected comments.

Who is affected by this vulnerability?

Users of TinyMCE who utilize the protect option are at risk of this vulnerability.

What are the consequences of this vulnerability?

If exploited, this vulnerability can lead to unauthorized access to user data and manipulation of the application, potentially compromising security.

How can I check if my application is affected?

You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.