High severity · published Oct 27, 2026
CVE-2026-116675
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
New
8.5
CVSS
–
EPSS
No
On KEV
Description
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
tinymce · tinymce
>= 8.5.1, < 8.9.3; >= 7.9.3, < 7.9.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116675
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116675
github.com
https://github.com/tinymce/tinymce/commit/bd1ab5ef024c648c3f9c0b409e54a6c227c7d8a2
github.com
https://github.com/tinymce/tinymce/releases/tag/8.9.3
github.com
https://github.com/tinymce/tinymce/security/advisories/GHSA-mf2p-h6hf-fcwm
www.tiny.cloud
https://www.tiny.cloud/docs/tinymce/7/7.9.4-release-notes/#overview
www.tiny.cloud
https://www.tiny.cloud/docs/tinymce/latest/8.9.3-release-notes/#overview
More from tinymce
5.4
CVE-2026-47762
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
5.4
CVE-2026-47761
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
5.4
CVE-2026-47759
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
5.4
CVE-2026-47760
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
–
CVE-2012-4230
The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to…