CVE-2026-47761

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

• CWE-79

• https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7wPatch, Vendor Advisory
• https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overviewRelease Notes
• https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overviewRelease Notes

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47752Tugtainer is a self-hosted app for automating updates of Doc…9.9
• CVE-2026-47754Metacat is data repository software that helps researchers p…9.3
• CVE-2026-47755ITFlow provides an IT documentation, ticketing and accountin…6.5
• CVE-2026-47759TinyMCE is an open source rich text editor. Prior to 5.11.1,…5.4
• CVE-2026-4776An SQL injection vulnerability exists in Mautic's API contac…7.1
• CVE-2026-47760TinyMCE is an open source rich text editor. From 6.8.0 to be…5.4
• CVE-2026-47762TinyMCE is an open source rich text editor. Prior to 5.11.1,…5.4
• CVE-2026-47763pdm is a Python package and dependency manager supporting th…6.8
• CVE-2026-47764pdm is a Python package and dependency manager supporting th…8.4
• CVE-2026-47765Frappe is a full-stack web application framework. Prior to 1…7.1
• CVE-2026-47767Symfony is a PHP framework for web and console applications …9.8
• CVE-2026-47768nebula-mesh is a self-hosted control plane for Slack Nebula …5.5