CVE-2026-47761: TinyMCE Cross-Site Scripting (XSS) Vulnerability via Media Plugin Injection
Summary
CVE-2026-47761: TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin data-mce-object injection. Affects tinymce across 2 version ranges.
>= 6.0.0, < 7.9.3
>= 8.0.0, < 8.5.1
Fixed in 7.9.3 or 8.5.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TinyMCE is a popular open-source rich text editor used in web applications to enable users to create and edit content in a user-friendly manner. It supports various features such as text formatting, media embedding, and plugin integration. However, the media plugin has been found to be vulnerable to a stored Cross-Site Scripting (XSS) attack, which can compromise the security of applications that utilize this editor.
Vulnerability Detail
The vulnerability arises from improper sanitization of user input in the media plugin, specifically through the use of 'data-mce-object' and 'data-mce-p-*' attributes. Attackers can exploit this flaw by injecting malicious scripts into these attributes, which are executed when the content is rendered. This can lead to unauthorized actions being performed on behalf of users, data theft, or other malicious activities.
How To Fix
Latest published version: 8.10.0 as of 23 Oct 2026
npm install tinymce@8.10.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 7.9.37.9.3npm install tinymce@7.9.3 -
>= 8.0.0, < 8.5.18.5.1npm install tinymce@8.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no official workarounds available for this vulnerability. The best course of action is to apply the necessary updates as soon as possible.
Conclusion
The TinyMCE Cross-Site Scripting vulnerability (CVE-2026-47761) poses a significant risk to applications using the media plugin. It is essential for developers to upgrade to the latest patched versions to safeguard their applications against potential attacks.
See every vulnerability recorded for tinymce →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
If exploited, this vulnerability can lead to unauthorized actions, data theft, and potentially compromise user accounts.
Yes, the vulnerability affects all versions of TinyMCE prior to 5.11.1, as well as versions 6.0.0 to 7.9.2 and 8.0.0 to 8.5.0.
While there are no official workarounds, it is crucial to prioritize upgrading to a patched version to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for tinymce.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
