{"id":"EUVD-2026-32922","enisaUuid":"e8b2e4ab-9a59-337c-b281-559dce3280f8","description":"TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.","datePublished":"May 28, 2026, 3:20:57 PM","dateUpdated":"May 28, 2026, 3:26:49 PM","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w\nhttps://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview\nhttps://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview\n","aliases":"CVE-2026-47761\nGHSA-vg35-5wq7-3x7w\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"2f3b2af5-b167-3ac3-88c0-4038d53373b8","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"7.0.0, \u003c 7.9.3"},{"id":"c413620f-12e3-3e28-80ed-4d46a4780908","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"8.0.0, \u003c 8.5.1"},{"id":"cfa48ac8-671f-362f-8adc-e08bdcf506f1","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"6.0.0, ≤ 6.8.6"},{"id":"f8f3718c-a127-3e0b-afb2-6811965d882d","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"\u003c 5.11.1"}],"enisaIdVendor":[{"id":"474d05a2-9367-33e5-bad9-8ed8b669765a","vendor":{"name":"tinymce"}}],"enisaIdVulnerability":[{"id":"69449f30-11ce-3465-abfd-9d091af09e2b","vulnerability":{"id":"CVE-2026-47761","description":"TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.","datePublished":"May 28, 2026, 3:20:57 PM","dateUpdated":"May 28, 2026, 3:26:49 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w\nhttps://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview\nhttps://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview\n","enisa_id":"EUVD-2026-32922\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Nov 9, 2026, 7:17:40 AM","vulnerabilityProduct":[{"id":"46b0aa57-393b-3c00-92b3-aa232be3cb3c","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"8.0.0, \u003c 8.5.1"},{"id":"6843a2f3-8ed4-3b2a-873f-e7e705ed54b0","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"\u003c 5.11.1"},{"id":"b5a03ece-3a20-30ec-8881-f556affe7150","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"6.0.0, ≤ 6.8.6"},{"id":"c547bc80-7d21-3bd1-9957-683fdc5729a7","product":{"name":"tinymce","vendor":{"name":"tinymce"}},"product_version":"7.0.0, \u003c 7.9.3"}],"vulnerabilityVendor":[{"id":"1ffa57cf-6d24-31f0-b905-75dc009a4eb7","vendor":{"name":"tinymce"}}]}},{"id":"a5f41c51-c65e-3e32-a060-1b799e56a5cf","vulnerability":{"id":"GHSA-vg35-5wq7-3x7w","description":"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection","datePublished":"Jun 5, 2026, 8:29:43 PM","dateUpdated":"Jun 30, 2026, 9:11:55 PM","baseScore":0.0,"references":"https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47761\nhttps://github.com/tinymce/tinymce\nhttps://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview\nhttps://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview\n","enisa_id":"EUVD-2026-32922\n","aliases":"CVE-2026-47761\nGHSA-vg35-5wq7-3x7w\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:58:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}