PT-2026-44390 · Tinymce · Tinymce

Unclej4Ck · Published 2026-05-28 · Updated 2026-06-08 · CVE-2026-47761

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE versions prior to 5.11.1 TinyMCE versions prior to 7.9.3 TinyMCE versions prior to 8.5.1

Description A stored Cross-Site Scripting (XSS) issue exists in the media plugin. Attackers can inject malicious scripts using specially crafted data-mce-* attributes, which are then executed when the content is rendered. This affects users who have the media plugin enabled.

Recommendations Update to version 5.11.1. Update to version 7.9.3. Update to version 8.5.1. As a temporary mitigation, disable the media plugin to prevent the execution of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-47761

GHSA-VG35-5WQ7-3X7W

Affected Products

Tinymce

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47761.json · Exploit
• https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-47761 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-47761 · Security Note
• https://osv.dev/vulnerability/GHSA-vg35-5wq7-3x7w · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-47761 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-47761 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-47761 · Vendor Advisory
• https://github.com/tinymce/tinymce · Note
• https://reddit.com/r/VulnMatter/comments/1ty4ggl/resumen_diario_de_vulnerabilidades_06062026 · Reddit Post
• https://tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview · Note
• https://reddit.com/r/VulnMatter/comments/1u0cddg/resumen_diario_de_vulnerabilidades_08062026 · Reddit Post
• https://twitter.com/dailycve/status/2060187936491004145 · Twitter Post
• https://tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview · Note