GHSA-vg35-5wq7-3x7w
High · 8.7CVSS
8.7
EPSS
—
Published
Jun 5, 2026
CISA due date
—
The record
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| NuGet | TinyMCE | 0 | No fix |
| NuGet | TinyMCE | 6.0.0 | 7.9.3 |
| NuGet | TinyMCE | 8.0.0 | 8.5.1 |
| Packagist | tinymce/tinymce | 0 | No fix |
| Packagist | tinymce/tinymce | 6.0.0 | 7.9.3 |
| Packagist | tinymce/tinymce | 8.0.0 | 8.5.1 |
| npm | tinymce | 0 | No fix |
| npm | tinymce | 6.0.0 | 7.9.3 |
| npm | tinymce | 8.0.0 | 8.5.1 |
Related vulnerabilities
- CVE-2026-47761 TinyMCE is an open source rich text editor. Same vulnerability
- GHSA-v98h-vmpc-fpqv TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments Also affects TinyMCE
- GHSA-q742-qvgc-gc2f TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src… Also affects TinyMCE
- GHSA-mh5m-5hw4-5c69 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested… Also affects TinyMCE
- CVE-2026-47759 TinyMCE is an open source rich text editor. Also affects TinyMCE
- CVE-2026-47762 TinyMCE is an open source rich text editor. Also affects TinyMCE
- CVE-2026-47760 TinyMCE is an open source rich text editor. Also affects TinyMCE
- CVE-2024-38356 TinyMCE is an open source rich text editor. Also affects TinyMCE