TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

Description

Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled.

Recommendation

Update the tinymce package to the latest compatible version. Followings are version details:

• Affected version(s): **> 0, <= 5.10.9

  >= 8.0.0, < 8.5.1

  >= 6.0.0, < 7.9.3**

• Patched version(s): **8.5.1

  7.9.3**

References

• GHSA-vg35-5wq7-3x7w
• www.tiny.cloud
• CVE-2026-47761
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - CVE-2026-47759
• TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - CVE-2026-47760
• TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments - CVE-2026-47762
• TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - CVE-2024-29881

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

tinymce