Vulnerability in tinymce

[ Description ]Official description

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

[ Fixes ]Fixes and patches

• Security bulletin: Moodle 482831Vendor patch or bulletin · CERT-FR · moodle.org/mod/forum/discuss.php, cited by CERT-FR CERTFR-2026-AVI-1318
• Security bulletin: Moodle 482830Vendor patch or bulletin · CERT-FR · moodle.org/mod/forum/discuss.php, cited by CERT-FR CERTFR-2026-AVI-1318

[ Advisories ]Government CERT advisories

• CERT-FR15 Oct 2026CERTFR-2026-AVI-1318

  Multiple vulnerabilities in Moodle Translated from French

  Multiple vulnerabilities have been discovered in Moodle. They allow an attacker to cause remote cross-site scripting (XSS) and a security policy bypass.

  CVE-2026-47762CVE-2026-47759CVE-2026-47761

[ References ]References

• github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqvx_refsource_CONFIRM
• www.tiny.cloud/docs/tinymce/7/7.9.3-release-notesx_refsource_MISC
• www.tiny.cloud/docs/tinymce/8/8.5.1-release-notesx_refsource_MISC