{"id":"CVE-2026-47762","sourceIdentifier":"security-advisories@github.com","published":"2026-05-28T16:16:28.470","lastModified":"2026-10-14T20:10:00.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1."},{"lang":"es","value":"TinyMCE es un editor de texto enriquecido de código abierto. Antes de las versiones 5.11.1, 7.9.3 y 8.5.1, existe una vulnerabilidad XSS almacenada mediante comentarios mce:protected falsificados. Permite a los atacantes eludir la sanitización e inyectar scripts que se ejecutan cuando el contenido es restaurado. Afecta a los usuarios que utilizan la opción de protección. Esta vulnerabilidad está corregida en las versiones 5.11.1, 7.9.3 y 8.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"tinymce","product":"tinymce","versions":[{"version":"< 5.11.1","status":"affected"},{"version":">= 6.0.0, <= 6.8.6","status":"affected"},{"version":">= 7.0.0, < 7.9.3","status":"affected"},{"version":">= 8.0.0, < 8.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-28T19:14:30.785872Z","id":"CVE-2026-47762","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*","versionEndExcluding":"5.11.1","matchCriteriaId":"33F45A92-27A3-41F4-91E3-4C3001F11E56"},{"vulnerable":true,"criteria":"cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"7.9.3","matchCriteriaId":"7A0B42F4-3EAA-49D5-B9DF-AB74687FB282"},{"vulnerable":true,"criteria":"cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.5.1","matchCriteriaId":"4F3C3EF2-FD5B-4CC3-B2A1-F6D496708272"}]}]}],"references":[{"url":"https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview","source":"security-advisories@github.com","tags":["Release Notes"]}]}