PT-2026-44388 · Tinymce · Tinymce

He1D3N + 1 · Published 2026-05-28 · Updated 2026-06-10 · CVE-2026-47759

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE versions prior to 5.11.1 TinyMCE versions prior to 7.9.3 TinyMCE versions prior to 8.5.1

Description A stored Cross-Site Scripting (XSS) issue exists due to unsanitized data-mce-* attributes, specifically data-mce-href, data-mce-src, and data-mce-style. This allows attackers to inject malicious values that override safe attributes during serialization, effectively bypassing validation.

Recommendations Update to version 5.11.1 LTS or higher. Update to version 7.9.3 or higher. Update to version 8.5.1 or higher.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-47759

GHSA-Q742-QVGC-GC2F

Affected Products

Tinymce

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47759.json · Exploit
• https://github.com/tinymce/tinymce/security/advisories/GHSA-q742-qvgc-gc2f · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-47759 · Security Note
• https://ubuntu.com/security/CVE-2026-47759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47759 · Security Note
• https://osv.dev/vulnerability/GHSA-q742-qvgc-gc2f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-47759 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-47759 · Vendor Advisory
• https://github.com/tinymce/tinymce · Note
• https://tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview · Note
• https://reddit.com/r/VulnMatter/comments/1ty4ggl/resumen_diario_de_vulnerabilidades_06062026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1u0cddg/resumen_diario_de_vulnerabilidades_08062026 · Reddit Post
• https://tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview · Note
• https://t.me/netlas/579 · Telegram Post
• https://twitter.com/Netlas_io/status/2064706696098848903 · Twitter Post