cyfenced.com →

[ CVE-2026-116675 · Published 27 Oct 2026 ]

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

CVSS 8.5 EPSS <1%Fix available

[ Description ]Official description

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.

[ Fixes ]Fixes and patches

  • tinymce 8.9.3Fixed version · GitHub Advisories · npm package tinymce: upgrade to 8.9.3 or later (affected >= 8.5.1, < 8.9.3)
  • tinymce/tinymce 8.9.3Fixed version · GitHub Advisories · composer package tinymce/tinymce: upgrade to 8.9.3 or later (affected >= 8.5.1, < 8.9.3)
  • tinymce 7.9.4Fixed version · GitHub Advisories · npm package tinymce: upgrade to 7.9.4 or later (affected = 7.9.3)
  • tinymce/tinymce 7.9.4Fixed version · GitHub Advisories · composer package tinymce/tinymce: upgrade to 7.9.4 or later (affected = 7.9.3)

[ Packages ]Affected open-source packages

[ References ]References