PT-2026-126686
CVE-2026-116675
·
Published
2026-10-27
·
Updated
2026-10-27
Description by
CVSS 4.0
8.5
HighMetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
TinyMCE versions 7.9.3 through 7.9.3
TinyMCE versions 8.5.1 through 8.9.2
Description
The media plugin allows the creation of elements via the
data-mce-object attribute in the active document before sanitization occurs. This flaw enables the execution of malicious scripts, leading to stored cross-site scripting (XSS), which is a technique where a script is permanently stored on a target server and executed in the browser of a user visiting the affected page.Recommendations
Upgrade to version 7.9.4 or higher.
Upgrade to version 8.9.3 or higher.
Found an issue in the description? Have something to add? Feel free to write us 👾