CVE-2026-116675

A flaw was found in TinyMCE. The media plugin creates elements in the active document before input sanitization occurs. An attacker can exploit this vulnerability by injecting specially crafted media attributes into a document, resulting in stored cross-site scripting XSS. When another user views...

CVE-2026-116675

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...

CVE-2026-47761

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce- attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media...

Cross-site Scripting (XSS)

TinyMCE is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to processing elements created through data-mce-object in the active document before sanitization, which allows an attacker to inject malicious scripts that execute during media processing and cause stored XSS in...

Cross-site Scripting (XSS)

TinyMCE is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to processing elements created through data-mce-object in the active document before sanitization, which allows an attacker to inject malicious scripts that execute during media processing and cause stored XSS when the...

Linux Distros Unpatched Vulnerability : CVE-2026-116675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object...

npm: TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

npm: TinyMCE Cross-Site Scripting XSS vulnerability using media plugin data-mce-object serialization discovered by ? in WordPress npm tinymce versions 7.9.3...

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled. Patches This vulnerability has been...

GHSA-MF2P-H6HF-FCWM TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled. Patches This vulnerability has been...

Cross-site Scripting (XSS)

Overview tinymce is a web-based JavaScript HTML WYSIWYG editor control. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the media plugin's buildMediaElement function in FilterContent.ts, where content derived from the data-mce-object attribute is used to create DO...

Cross-site Scripting (XSS)

Overview TinyMCE is a web-based JavaScript HTML WYSIWYG editor control. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the media plugin's buildMediaElement function in FilterContent.ts, where content derived from the data-mce-object attribute is used to create DO...

Cross-site Scripting (XSS)

Overview tinymce/tinymce is a web-based JavaScript HTML WYSIWYG editor control. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the media plugin's buildMediaElement function in FilterContent.ts, where content derived from the data-mce-object attribute is used to...

Cross-site Scripting (XSS)

Overview org.webjars.npm:tinymce is a WebJar for tinymce. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the media plugin's buildMediaElement function in FilterContent.ts, where content derived from the data-mce-object attribute is used to create DOM elements...

CVE-2026-116675

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...

UBUNTU-CVE-2026-116675

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...

CVE-2026-116675

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...

CVE-2026-116675 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...

CVE-2026-116675

The TinyMCE open-source rich text editor is vulnerable to stored cross-site scripting (XSS) in versions 7.9.3 through 7.9.4 and 8.5.1 through 8.9.3 . The vulnerability exists because the media plugin creates elements via data-mce-object in the active document before sanitization, allowing malicio...

CVE-2026-116675 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...

EUVD-2026-111106

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...