{"id":"EUVD-2026-32920","enisaUuid":"dfde8fa0-dffb-3051-afe4-a7f12a01410b","description":"TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.","datePublished":"May 28, 2026, 3:18:22 PM","dateUpdated":"Jun 2, 2026, 3:58:47 PM","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/tinymce/tinymce/security/advisories/GHSA-mh5m-5hw4-5c69\n","aliases":"CVE-2026-47760\nGHSA-mh5m-5hw4-5c69\n","assigner":"GitHub_M","epss":0.19,"enisaIdProduct":[{"id":"7340b9ff-f9c6-3f7b-895e-314967d99f82","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"6.0.0, \u003c 7.1.0"}],"enisaIdVendor":[{"id":"399d4f96-6a64-3545-bbcd-e5011330d2d5","vendor":{"name":"tinymce"}}],"enisaIdVulnerability":[{"id":"35573e9d-ed27-3faf-9d2c-a6e5414913f7","vulnerability":{"id":"CVE-2026-47760","description":"TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.","datePublished":"May 28, 2026, 3:18:22 PM","dateUpdated":"Jun 2, 2026, 3:58:47 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/tinymce/tinymce/security/advisories/GHSA-mh5m-5hw4-5c69\n","enisa_id":"EUVD-2026-32920\n","assigner":"GitHub_M","epss":0.19,"dataProcessed":"Oct 28, 2026, 7:17:45 AM","vulnerabilityProduct":[{"id":"e1a7c43d-8f8d-3cb5-8f3d-c3af91a5489b","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"6.0.0, \u003c 7.1.0"}],"vulnerabilityVendor":[{"id":"566955a4-65df-3806-bbe7-d78718b29101","vendor":{"name":"tinymce"}}]}},{"id":"72e5b50c-e5b9-37d0-9a8b-371384ce662b","vulnerability":{"id":"GHSA-mh5m-5hw4-5c69","description":"TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs","datePublished":"Jun 5, 2026, 8:09:38 PM","dateUpdated":"Jun 5, 2026, 8:09:38 PM","baseScore":0.0,"references":"https://github.com/tinymce/tinymce/security/advisories/GHSA-mh5m-5hw4-5c69\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47760\nhttps://github.com/tinymce/tinymce\n","enisa_id":"EUVD-2026-32920\n","aliases":"CVE-2026-47760\nGHSA-mh5m-5hw4-5c69\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:56:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}