PT-2026-44390

CVE-2026-47761

Published

2026-05-28

Updated

2026-09-18

Description by

CVSS 3.1

8.7

High

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TinyMCE versions prior to 5.11.1 TinyMCE versions prior to 7.9.3 TinyMCE versions prior to 8.5.1

Description A stored Cross-Site Scripting (XSS) issue exists in the media plugin. Attackers can inject malicious scripts using specially crafted data-mce-* attributes, which are then executed when the content is rendered. This affects users who have the media plugin enabled.

Recommendations Update to version 5.11.1. Update to version 7.9.3. Update to version 8.5.1. As a temporary mitigation, disable the media plugin to prevent the execution of malicious scripts.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-47761

GHSA-VG35-5WQ7-3X7W