{"id":"EUVD-2026-111106","enisaUuid":"5714aa5a-dad3-383b-8d60-3d52b355d5d9","description":"TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.","datePublished":"Oct 27, 2026, 4:47:01 PM","dateUpdated":"Oct 27, 2026, 4:47:01 PM","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/tinymce/tinymce/security/advisories/GHSA-mf2p-h6hf-fcwm\nhttps://github.com/tinymce/tinymce/commit/bd1ab5ef024c648c3f9c0b409e54a6c227c7d8a2\nhttps://github.com/tinymce/tinymce/releases/tag/8.9.3\nhttps://www.tiny.cloud/docs/tinymce/7/7.9.4-release-notes/#overview\nhttps://www.tiny.cloud/docs/tinymce/latest/8.9.3-release-notes/#overview\n","aliases":"CVE-2026-116675\nGHSA-mf2p-h6hf-fcwm\n","assigner":"GitHub_M","epss":0.0,"enisaIdProduct":[{"id":"69de24a1-5eb8-328d-a152-ada6d0ba8b01","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"7.9.3, \u003c 7.9.4"},{"id":"c796c31f-a80d-3832-8057-0b9a0eb42ae3","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"8.5.1, \u003c 8.9.3"}],"enisaIdVendor":[{"id":"b5e46605-d36f-3307-b2ce-ce95e649071e","vendor":{"name":"tinymce"}}],"enisaIdVulnerability":[{"id":"a9cc6588-f5f6-3476-acab-97e0589fd3fb","vulnerability":{"id":"CVE-2026-116675","description":"TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.","datePublished":"Oct 27, 2026, 4:47:01 PM","dateUpdated":"Oct 27, 2026, 4:47:01 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/tinymce/tinymce/security/advisories/GHSA-mf2p-h6hf-fcwm\nhttps://github.com/tinymce/tinymce/commit/bd1ab5ef024c648c3f9c0b409e54a6c227c7d8a2\nhttps://github.com/tinymce/tinymce/releases/tag/8.9.3\nhttps://www.tiny.cloud/docs/tinymce/7/7.9.4-release-notes/#overview\nhttps://www.tiny.cloud/docs/tinymce/latest/8.9.3-release-notes/#overview\n","enisa_id":"EUVD-2026-111106\n","assigner":"GitHub_M","epss":0.0,"dataProcessed":"Oct 28, 2026, 2:00:18 AM","vulnerabilityProduct":[{"id":"0f2e42e5-f428-3421-ab01-bd3e866781fe","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"8.5.1, \u003c 8.9.3"},{"id":"83981c5e-8483-3f7f-baf3-2f916153b24f","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"7.9.3, \u003c 7.9.4"}],"vulnerabilityVendor":[{"id":"b82b495b-75e8-374a-8365-876d25d2fe0e","vendor":{"name":"tinymce"}}]}},{"id":"ee619345-3011-35bc-bea6-09b9af014065","vulnerability":{"id":"GHSA-mf2p-h6hf-fcwm","description":"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization","datePublished":"Oct 27, 2026, 9:07:12 PM","dateUpdated":"Oct 27, 2026, 9:07:12 PM","baseScore":0.0,"references":"https://github.com/tinymce/tinymce/security/advisories/GHSA-mf2p-h6hf-fcwm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116675\nhttps://github.com/tinymce/tinymce/commit/bd1ab5ef024c648c3f9c0b409e54a6c227c7d8a2\nhttps://github.com/tinymce/tinymce\nhttps://github.com/tinymce/tinymce/releases/tag/8.9.3\nhttps://www.tiny.cloud/docs/tinymce/7/7.9.4-release-notes/#overview\nhttps://www.tiny.cloud/docs/tinymce/latest/8.9.3-release-notes/#overview\n","enisa_id":"EUVD-2026-111106\n","aliases":"CVE-2026-116675\nGHSA-mf2p-h6hf-fcwm\n","epss":0.0,"dataProcessed":"Oct 28, 2026, 2:02:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}