TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

Description

Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled.

Recommendation

Update the tinymce package to the latest compatible version. Followings are version details:

• Affected version(s): **> 0, <= 5.10.9

  >= 8.0.0, < 8.5.1

  >= 6.0.0, < 7.9.3**

• Patched version(s): **8.5.1

  7.9.3**

References

• GHSA-vg35-5wq7-3x7w
• www.tiny.cloud
• CVE-2026-47761
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6