{"id":"EUVD-2026-32921","enisaUuid":"dadafada-fd99-3216-b5f0-6d80ee7a4082","description":"TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.","datePublished":"May 28, 2026, 3:20:11 PM","dateUpdated":"May 30, 2026, 1:58:37 AM","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/tinymce/tinymce/security/advisories/GHSA-q742-qvgc-gc2f\nhttps://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview\nhttps://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview\n","aliases":"CVE-2026-47759\nGHSA-q742-qvgc-gc2f\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"187503c7-153b-3b6f-96b4-ad5c03821139","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"\u003c 5.11.1"},{"id":"90b19bcb-0f68-3733-968f-bdd433316437","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"6.0.0, ≤ 6.8.6"},{"id":"d017efec-c35a-3c75-800d-a5ce5c0e43a0","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"7.0.0, \u003c 7.9.3"},{"id":"ec378420-556e-3b86-9a0f-870bfa43b0a4","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"8.0.0, \u003c 8.5.1"}],"enisaIdVendor":[{"id":"9a84bf42-ab49-3724-bf2f-e243e7154a8d","vendor":{"name":"tinymce"}}],"enisaIdVulnerability":[{"id":"76927cb3-f72a-3370-ac05-39f21956d5f4","vulnerability":{"id":"GHSA-q742-qvgc-gc2f","description":"TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes","datePublished":"Jun 5, 2026, 8:27:50 PM","dateUpdated":"Jul 7, 2026, 5:10:01 PM","baseScore":0.0,"references":"https://github.com/tinymce/tinymce/security/advisories/GHSA-q742-qvgc-gc2f\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47759\nhttps://github.com/tinymce/tinymce\nhttps://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview\nhttps://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview\n","enisa_id":"EUVD-2026-32921\n","aliases":"CVE-2026-47759\nGHSA-q742-qvgc-gc2f\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:56:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ed9ce59b-c834-3fbd-b1c6-51562cc3ffa2","vulnerability":{"id":"CVE-2026-47759","description":"TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.","datePublished":"May 28, 2026, 3:20:11 PM","dateUpdated":"May 30, 2026, 1:58:37 AM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/tinymce/tinymce/security/advisories/GHSA-q742-qvgc-gc2f\nhttps://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview\nhttps://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview\n","enisa_id":"EUVD-2026-32921\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Oct 30, 2026, 7:18:17 AM","vulnerabilityProduct":[{"id":"33855a41-da26-35a8-a640-c18145e534f4","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"6.0.0, ≤ 6.8.6"},{"id":"3be7356c-5deb-37d7-8703-fcee6581ee1d","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"\u003c 5.11.1"},{"id":"a086df5d-f50a-31b9-a646-c473b24b2b00","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"8.0.0, \u003c 8.5.1"},{"id":"a74ad6ac-c6db-3a38-9bc4-e3bb3a8ed44a","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"7.0.0, \u003c 7.9.3"}],"vulnerabilityVendor":[{"id":"20eb70e9-042a-3a8d-864a-ba6d3439f096","vendor":{"name":"tinymce"}}]}}],"enisaIdAdvisory":[]}