TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

ALTO 8.5CVE-2026-116675 · GHSA-mf2p-h6hf-fcwm · Published 27/10/2026 · updated 28/10/2026

En resumen

CVE-2026-116675 es una vulnerabilidad ALTO (CVSS 8.5) que afecta a TinyMCE, tinymce/tinymce, tinymce.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.35%, mayor que el 28.5% de las vulnerabilidades.
Solución: actualizar a 7.9.4, 8.9.3 o posterior.

Package	Affected versions	Patched versions
TinyMCE NuGet	`≥ 7.9.3, < 7.9.4≥ 8.5.1, < 8.9.3`	`7.9.48.9.3`
tinymce/tinymce Packagist	`≥ 7.9.3, < 7.9.4≥ 8.5.1, < 8.9.3`	`7.9.48.9.3`
tinymce npm	`≥ 7.9.3, < 7.9.4≥ 8.5.1, < 8.9.3`	`7.9.48.9.3`

Description

Impact

Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled.

Patches

This vulnerability has been patched in TinyMCE 8.9.3 and TinyMCE 7.9.4 by ensuring that, when using the media plugin, any content created through the data-mce-object attribute is properly sanitized first.

Workarounds

No official workaround available.

Fix

To avoid this vulnerability:

Upgrade to TinyMCE 8.9.3 or higher. Upgrade to TinyMCE 7.9.4 or higher.

Acknowledgements

Tiny thanks Fariskhi Vidyan and David Vieira Kurz (HiSolutions AG) for their help identifying this vulnerability.

NVD description

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.