Medium severity · published May 28, 2026
CVE-2026-47762
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
tinymce · tinymce
< 5.11.1; >= 6.0.0, <= 6.8.6; >= 7.0.0, < 7.9.3; >= 8.0.0, < 8.5.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47762
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47762
Vendor Advisory
https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv
Release Notes
https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview
Release Notes
https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview
More from tinymce
8.5
CVE-2026-116675
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
5.4
CVE-2026-47761
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
5.4
CVE-2026-47759
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
5.4
CVE-2026-47760
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
–
CVE-2012-4230
The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to…