TinyMCE CVE-2026-47761: Overview of a High Severity Stored XSS via Media Plugin data-mce-object Injection

Introduction

A stored cross-site scripting vulnerability in TinyMCE's media plugin lets attackers with low privileges inject persistent malicious scripts that run in the browser of anyone who views the compromised content. Those scripts cross the editor's security boundary into the hosting application. With a CVSS v3.1 score of 8.7, this is the highest-severity CVE ever assigned to TinyMCE, and the entire 6.x branch will never receive a patch because it has reached end of life.

TinyMCE is one of the two dominant rich text editors on the web. According to developer survey data, TinyMCE and CKEditor together account for approximately 58% of the rich text editor market. TinyMCE is embedded in everything from WordPress (as the classic editor) to enterprise SaaS products, so the potential blast radius of this vulnerability across web applications is large.

Technical information

Root cause: insufficient sanitization of internal attributes

CVE-2026-47761 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability is in TinyMCE's media plugin, which handles embedded media objects such as video, audio, and iframe content.

When the media plugin processes embedded media elements, it converts them into TinyMCE's internal representation using custom HTML attributes: data-mce-object and data-mce-p-*. These attributes preserve editor state and let the editor render media content correctly within its document model. TinyMCE's content sanitization fails to properly neutralize malicious payloads placed in these internal attributes during conversion and reconstruction.

CVSS vector breakdown

The full CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, which breaks down as follows:

The Scope: Changed metric is what sets this CVE apart from every earlier TinyMCE vulnerability. It means an XSS payload injected through TinyMCE can compromise the security context of the whole web application, beyond the editor component. Session tokens, authentication cookies, and application data belonging to the hosting application are all within reach of the attacker's script.

Attack flow

Exploitation follows a stored XSS pattern:

1. Injection: An attacker with low privileges (such as a content author or commenter) submits HTML through TinyMCE that contains crafted data-mce-object and data-mce-p-* attributes carrying malicious JavaScript payloads.

2. Storage: The application saves this content to its backend storage (typically a database). Because TinyMCE's sanitization fails to strip or neutralize the malicious attributes during processing, the payload survives the save intact.

3. Rendering: When any user (including administrators) views the stored content, TinyMCE's media plugin processes the data-mce-object and data-mce-p-* attributes to reconstruct the media elements. During this reconstruction, the malicious script is injected into the rendered DOM and executes in the victim's browser session.

4. Impact: The attacker's script runs with the full privileges of the victim's session in the context of the hosting application. Depending on the victim's role, the attacker can hijack sessions, steal credentials, exfiltrate data, and move further laterally.

Because this is stored XSS rather than reflected XSS, the payload is durable and scalable. Every user who views the compromised content triggers it, with no per-victim social engineering.

Prerequisite: the media plugin must be enabled

The vulnerability requires the TinyMCE media plugin to be enabled. Applications that do not load the media plugin are not affected. That matters for compensating controls, because deployments that do not need embedded media can disable the plugin and remove the attack surface entirely.

Affected systems and versions

The vulnerability affects the following TinyMCE version ranges:

The 6.x branch is the most critical exposure. TinyMCE 6 open source reached end of life on October 31, 2024, and the commercial version reached end of life on June 6, 2025. No security patches will be issued for this branch. Every TinyMCE 6.x deployment stays permanently vulnerable unless it migrates to a supported version or engages a third party such as HeroDevs for extended commercial LTS support.

The 5.11.1 fix is only available to organizations with a commercial long-term support contract from Tiny Technologies.

Any application that embeds TinyMCE with the media plugin enabled is potentially affected. That includes content management systems, blogging platforms, enterprise applications, and any other web application that uses TinyMCE for rich text editing with media embedding.

Remediation

The GitHub advisory states explicitly that there is no official workaround for this vulnerability. The only supported remediation is to upgrade to a patched version:

• TinyMCE 8.x: Upgrade to 8.5.1 or later
• TinyMCE 7.x: Upgrade to 7.9.3 or later
• TinyMCE 5.x: Upgrade to 5.11.1 (commercial LTS)
• TinyMCE 6.x: Migrate to 7.9.3 or 8.5.1, or engage HeroDevs for extended support

For organizations that cannot upgrade immediately, these compensating controls may reduce risk:

• Disable the media plugin if it is not required.
• Set strict Content Security Policy headers with restrictive script-src directives.
• Deploy WAF rules that detect data-mce-object and data-mce-p-* attribute patterns in submitted content.
• Scan existing stored content for malicious data-mce-* attribute patterns.

Vendor security history

TinyMCE has a well-documented history of XSS vulnerabilities. CVE-2026-47761 is the latest in a series of at least 12 CVEs, nearly all of them cross-site scripting variants. That pattern suggests a systemic problem with content sanitization in the TinyMCE codebase.

Notable prior CVEs include:

At 8.7, CVE-2026-47761 scores well above every prior TinyMCE CVE, most of which scored between 4.3 and 6.1. The higher score comes mainly from the Scope: Changed metric and the High confidentiality and integrity impact ratings.

The media plugin has been a target before. CVE-2019-1010091 also used the media element's embed tab for XSS injection, which makes CVE-2026-47761 the second known XSS vulnerability in this component.

Tiny Technologies ended support for TinyMCE 6 without backporting security fixes for this vulnerability or for earlier CVEs such as CVE-2024-29203 and CVE-2024-29881. The result is a growing population of permanently vulnerable deployments, a concern HeroDevs raised in its March 2026 analysis.

Threat landscape context

As of May 28, 2026, there is no confirmed evidence that CVE-2026-47761 is being actively exploited in the wild. The CVE was published that same day, and it does not appear in CISA's Known Exploited Vulnerabilities catalog.

Still, Proofpoint telemetry from late May 2026 identified 12 distinct 2026 CVEs being actively exploited in network-facing attacks, which shows that threat actors are quickly weaponizing newly disclosed vulnerabilities. Because this XSS is stored, it reaches every user who views the compromised content without per-victim social engineering, and that makes it especially attractive for session hijacking, credential theft, and malware delivery campaigns. The media plugin has also been exploited before (CVE-2019-1010091), which indicates threat actors already know this attack surface.

Credits

Aymane MAZGUITI (@UncleJ4ck) and Ange Primiterra (@ange_primiterra) discovered and reported this vulnerability. Tiny Technologies credits them in the GitHub advisory.

References

• GitHub Advisory GHSA-vg35-5wq7-3x7w: TinyMCE XSS via media plugin data-mce-object injection
• NVD: CVE-2026-47761
• TinyMCE 8.5.1 Release Notes
• TinyMCE 7.9.3 Release Notes
• TinyMCE Security Guide
• TinyMCE Support and Version Lifecycle
• HeroDevs: TinyMCE 6 End of Life and Unpatched XSS Vulnerabilities
• OpenCVE: TinyMCE CVEs and Security Vulnerabilities
• Cybersecurity Help: Cross site scripting in TinyMCE VU131920
• Proofpoint: 2026 Vulnerability Exploitation in the Wild