CVE-2026-47762

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

CVSS v3 8.7 HIGH

8.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv	Vendor Advisory
https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview	Release Notes
https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview	Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:tiny:tinymce::::::::
	cpe:2.3:a:tiny:tinymce::::::::
	cpe:2.3:a:tiny:tinymce::::::::

History

No history.

Information

Published : 2026-05-28 16:16

Updated : 2026-06-17 10:54

NVD link : CVE-2026-47762

Mitre link : CVE-2026-47762

CVE.ORG link : CVE-2026-47762

JSON object : View

Products Affected

tiny

tinymce

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-47762", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47762", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-28T19:14:30.785872Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "tinymce", "product": "tinymce", "versions": [{"status": "affected", "version": "< 5.11.1"}, {"status": "affected", "version": ">= 6.0.0, <= 6.8.6"}, {"status": "affected", "version": ">= 7.0.0, < 7.9.3"}, {"status": "affected", "version": ">= 8.0.0, < 8.5.1"}]}]}], "published": "2026-05-28T16:16:28.470", "references": [{"url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview", "tags": ["Release Notes"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1."}], "lastModified": "2026-06-17T10:54:39.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33F45A92-27A3-41F4-91E3-4C3001F11E56", "versionEndExcluding": "5.11.1"}, {"criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A0B42F4-3EAA-49D5-B9DF-AB74687FB282", "versionEndExcluding": "7.9.3", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F3C3EF2-FD5B-4CC3-B2A1-F6D496708272", "versionEndExcluding": "8.5.1", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}