Vulnerability in tinymce

[ Description ]Official description

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

[ Fixes ]Fixes and patches

• Security bulletin: Moodle 482831Vendor patch or bulletin · CERT-FR · moodle.org/mod/forum/discuss.php, cited by CERT-FR CERTFR-2026-AVI-1318
• Security bulletin: Moodle 482830Vendor patch or bulletin · CERT-FR · moodle.org/mod/forum/discuss.php, cited by CERT-FR CERTFR-2026-AVI-1318

[ Advisories ]Government CERT advisories

• CERT-FR15 Oct 2026CERTFR-2026-AVI-1318

  Multiple vulnerabilities in Moodle Translated from French

  Multiple vulnerabilities have been discovered in Moodle. They allow an attacker to cause remote cross-site scripting (XSS) and a security policy bypass.

  CVE-2026-47762CVE-2026-47759CVE-2026-47761

[ References ]References

• github.com/tinymce/tinymce/security/advisories/GHSA-q742-qvgc-gc2fx_refsource_CONFIRM
• www.tiny.cloud/docs/tinymce/7/7.9.3-release-notesx_refsource_MISC
• www.tiny.cloud/docs/tinymce/8/8.5.1-release-notesx_refsource_MISC