PT-2026-44391 · Tinymce · Tinymce

He1D3N · Published 2026-05-28 · Updated 2026-06-10 · CVE-2026-47762

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE versions prior to 5.11.1 TinyMCE versions prior to 7.9.3 TinyMCE versions prior to 8.5.1

Description A stored Cross-Site Scripting (XSS) issue exists via forged mce:protected comments. This allows attackers to bypass sanitization and inject scripts that execute when content is restored. The issue impacts users who utilize the protect option.

Recommendations Update to version 5.11.1 Update to version 7.9.3 Update to version 8.5.1

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-47762

GHSA-V98H-VMPC-FPQV

Affected Products

Tinymce

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47762.json · Exploit
• https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-47762 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47762 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-47762 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v98h-vmpc-fpqv · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-47762 · Security Note
• https://osv.dev/vulnerability/CVE-2026-47762 · Vendor Advisory
• https://github.com/tinymce/tinymce · Note
• https://tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview · Note
• https://reddit.com/r/VulnMatter/comments/1ty4ggl/resumen_diario_de_vulnerabilidades_06062026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1u0cddg/resumen_diario_de_vulnerabilidades_08062026 · Reddit Post
• https://tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview · Note
• https://t.me/netlas/579 · Telegram Post
• https://twitter.com/dailycve/status/2060189231276790166 · Twitter Post