CVE-2026-116675

The TinyMCE open-source rich text editor is vulnerable to stored cross-site scripting (XSS) in versions 7.9.3 through 7.9.4 and 8.5.1 through 8.9.3 . The vulnerability exists because the media plugin creates elements via data-mce-object in the active document before sanitization, allowing malicio...