{"id":"EUVD-2026-111106","revision":"f8f0dfe46d8b4f04b7c1a1b1a70ae17d","records":[{"revision":"f8f0dfe46d8b4f04b7c1a1b1a70ae17d","observedAt":"2026-10-30T02:00:12.858+00:00","statement":{"source":"euvd","id":"EUVD-2026-111106","aliases":["CVE-2026-116675","GHSA-mf2p-h6hf-fcwm"],"title":"TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute maliciou…","description":"TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.5,"severity":null}],"references":["https://github.com/tinymce/tinymce/security/advisories/GHSA-mf2p-h6hf-fcwm","https://github.com/tinymce/tinymce/commit/bd1ab5ef024c648c3f9c0b409e54a6c227c7d8a2","https://github.com/tinymce/tinymce/releases/tag/8.9.3","https://www.tiny.cloud/docs/tinymce/7/7.9.4-release-notes/#overview","https://www.tiny.cloud/docs/tinymce/latest/8.9.3-release-notes/#overview"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-111106","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 27, 2026, 4:47:01 PM","dateUpdated":"Oct 28, 2026, 4:15:12 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-111106","identifiers":["EUVD-2026-111106","CVE-2026-116675","GHSA-mf2p-h6hf-fcwm"]},"retained":false,"historicalAffected":[]}],"coverage":[]}