Vulnerability-Lookup

CVE-2026-47761 (GCVE-0-2026-47761)

Vulnerability from cvelistv5 – Published: 2026-05-28 15:20 – Updated: 2026-05-28 15:26

Title

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

Summary

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-28 15:26 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/tinymce/tinymce/security/advis…	x_refsource_CONFIRM
https://www.tiny.cloud/docs/tinymce/7/7.9.3-relea…	x_refsource_MISC
https://www.tiny.cloud/docs/tinymce/8/8.5.1-relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
tinymce	tinymce	Affected: < 5.11.1 Affected: >= 6.0.0, <= 6.8.6 Affected: >= 7.0.0, < 7.9.3 Affected: >= 8.0.0, < 8.5.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47761",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T15:26:42.465256Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T15:26:49.455Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tinymce",
          "vendor": "tinymce",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.11.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c= 6.8.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.9.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T15:20:57.814Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w"
        },
        {
          "name": "https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview"
        },
        {
          "name": "https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
        }
      ],
      "source": {
        "advisory": "GHSA-vg35-5wq7-3x7w",
        "discovery": "UNKNOWN"
      },
      "title": "TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47761",
    "datePublished": "2026-05-28T15:20:57.814Z",
    "dateReserved": "2026-05-19T22:36:16.881Z",
    "dateUpdated": "2026-05-28T15:26:49.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47761",
      "date": "2026-09-20",
      "epss": "0.00264",
      "percentile": "0.18616"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "tinymce",
                "vendor": "tinymce",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 5.11.1"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 6.0.0, \u003c= 6.8.6"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 7.0.0, \u003c 7.9.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 8.0.0, \u003c 8.5.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "33F45A92-27A3-41F4-91E3-4C3001F11E56",
                    "versionEndExcluding": "5.11.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7A0B42F4-3EAA-49D5-B9DF-AB74687FB282",
                    "versionEndExcluding": "7.9.3",
                    "versionStartIncluding": "6.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4F3C3EF2-FD5B-4CC3-B2A1-F6D496708272",
                    "versionEndExcluding": "8.5.1",
                    "versionStartIncluding": "8.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1."
          }
        ],
        "id": "CVE-2026-47761",
        "lastModified": "2026-06-17T10:54:39.837",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 5.8,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-47761",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T15:26:42.465256Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-28T16:16:28.337",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-08-24T17:50:18+00:00",
      "cve": "CVE-2026-47761",
      "id": "CVE-2026-47761",
      "initial_release_date": "2026-05-28T15:20:57.814000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "TinyMCE: Cross-Site Scripting (XSS) vulnerability using media plugin data-mce-object injection",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47761.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-47761",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-28T15:26:42.465256Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-28T15:26:46.243Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "tinymce",
              "vendor": "tinymce",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 5.11.1"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 6.0.0, \u003c= 6.8.6"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 7.0.0, \u003c 7.9.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 8.0.0, \u003c 8.5.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-28T15:20:57.814Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w"
            },
            {
              "name": "https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview"
            },
            {
              "name": "https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
            }
          ],
          "source": {
            "advisory": "GHSA-vg35-5wq7-3x7w",
            "discovery": "UNKNOWN"
          },
          "title": "TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-47761",
        "datePublished": "2026-05-28T15:20:57.814Z",
        "dateReserved": "2026-05-19T22:36:16.881Z",
        "dateUpdated": "2026-05-28T15:26:49.455Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CLEANSTART-2026-LJ04584 (CVE-2026-47761)

Vulnerability from cleanstart – Published: 2026-09-18 09:55 – Updated: 2026-07-15 13:21 – Source website

Summary

Security fix for CVE-2026-47761 applied in: thingsboard-tb-web-ui 4.3.1.1-r1

Details

Security vulnerability affects the thingsboard-tb-web-ui package. This issue is resolved in later releases. See references for vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-47761	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-47761	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "thingsboard-tb-web-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.1.1-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Security vulnerability affects the thingsboard-tb-web-ui package. This issue is resolved in later releases. See references for vulnerability details.",
  "id": "CLEANSTART-2026-LJ04584",
  "modified": "2026-07-15T13:21:27Z",
  "published": "2026-09-18T09:55:06.264558Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LJ04584.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-47761"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47761"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fix for CVE-2026-47761 applied in: thingsboard-tb-web-ui 4.3.1.1-r1",
  "upstream": [
    "CVE-2026-47761"
  ]
}

CLEANSTART-2026-NU98727 (CVE-2026-8723)

Vulnerability from cleanstart – Published: 2026-07-30 07:10 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in thingsboard-tb-web-ui 4.3.1.1-r1

Details

Package thingsboard-tb-web-ui version 4.3.1.1-r1 fixes 10 vulnerabilities: CVE-2026-8723, CVE-2026-53655, CVE-2026-47759, CVE-2026-47761, CVE-2026-47762...

References

URL

Type

https://github.com/thingsboard/thingsboard

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "thingsboard-tb-web-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.1.1-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.3.1.1-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package thingsboard-tb-web-ui version 4.3.1.1-r1 fixes 10 vulnerabilities: CVE-2026-8723, CVE-2026-53655, CVE-2026-47759, CVE-2026-47761, CVE-2026-47762...",
  "id": "CLEANSTART-2026-NU98727",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/thingsboard/thingsboard"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in thingsboard-tb-web-ui 4.3.1.1-r1",
  "upstream": [
    "CVE-2026-8723",
    "CVE-2026-53655",
    "CVE-2026-47759",
    "CVE-2026-47761",
    "CVE-2026-47762",
    "ghsa-q742-qvgc-gc2f",
    "ghsa-v98h-vmpc-fpqv",
    "ghsa-vg35-5wq7-3x7w",
    "ghsa-q8mj-m7cp-5q26",
    "ghsa-vmf3-w455-68vh"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

FKIE_CVE-2026-47761

Vulnerability from fkie_nvd - Published: 2026-05-28 16:16 - Updated: 2026-06-17 10:54

Severity

8.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w	Patch, Vendor Advisory
security-advisories@github.com	https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview	Release Notes
security-advisories@github.com	https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview	Release Notes

Impacted products

Vendor	Product	Version
tiny	tinymce	*
tiny	tinymce	*
tiny	tinymce	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "tinymce",
          "vendor": "tinymce",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.11.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c= 6.8.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.9.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.5.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "33F45A92-27A3-41F4-91E3-4C3001F11E56",
              "versionEndExcluding": "5.11.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A0B42F4-3EAA-49D5-B9DF-AB74687FB282",
              "versionEndExcluding": "7.9.3",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F3C3EF2-FD5B-4CC3-B2A1-F6D496708272",
              "versionEndExcluding": "8.5.1",
              "versionStartIncluding": "8.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1."
    }
  ],
  "id": "CVE-2026-47761",
  "lastModified": "2026-06-17T10:54:39.837",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47761",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-28T15:26:42.465256Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-28T16:16:28.337",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VG35-5WQ7-3X7W

Vulnerability from github – Published: 2026-06-05 20:29 – Updated: 2026-06-30 21:11

Summary

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

Details

Impact

Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled.

Patches

This vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with data-mce-object and data-mce-p-* attributes are properly sanitized.

Workarounds

No official workaround available.

Fix

To avoid this vulnerability:

Upgrade to TinyMCE 8.5.1 or higher.
Upgrade to TinyMCE 7.9.3 or higher.
Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract).

Acknowledgements

Tiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability.

Severity

8.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "tinymce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.10.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "tinymce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "7.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "tinymce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "TinyMCE"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.10.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "TinyMCE"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "7.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "TinyMCE"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "tinymce/tinymce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.10.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "tinymce/tinymce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "7.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "tinymce/tinymce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47761"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-05T20:29:43Z",
    "nvd_published_at": "2026-05-28T16:16:28Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted `data-mce-*` attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with `data-mce-object` and `data-mce-p-*` attributes are properly sanitized.\n\n### Workarounds\nNo official workaround available.\n\n### Fix\nTo avoid this vulnerability:\n\n- Upgrade to TinyMCE 8.5.1 or higher.\n- Upgrade to TinyMCE 7.9.3 or higher.\n- Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial [long-term support](https://www.tiny.cloud/long-term-support/) contract).\n\n### Acknowledgements\nTiny thanks [Aymane MAZGUITI](https://github.com/UncleJ4ck) and [Ange Primiterra](https://github.com/ange-primiterra) for their help identifying this vulnerability.",
  "id": "GHSA-vg35-5wq7-3x7w",
  "modified": "2026-06-30T21:11:55Z",
  "published": "2026-06-05T20:29:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47761"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tinymce/tinymce"
    },
    {
      "type": "WEB",
      "url": "https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview"
    },
    {
      "type": "WEB",
      "url": "https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection"
}

UBUNTU-CVE-2026-47761 (CVE-2026-47761)

Vulnerability from osv_ubuntu – Published: 2026-05-28 16:16 – Updated: 2026-06-03 11:26 – Source website

Details

Severity

8.7 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

5.4 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-47761	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-47761	REPORT
	https://github.com/tinymce/tinymce/security/advis…	REPORT
	https://www.tiny.cloud/docs/tinymce/7/7.9.3-relea…	REPORT
	https://www.tiny.cloud/docs/tinymce/8/8.5.1-relea…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "tinymce",
            "binary_version": "3.4.8+dfsg0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "tinymce",
        "purl": "pkg:deb/ubuntu/tinymce@3.4.8+dfsg0-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.4.8+dfsg0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "tinymce",
            "binary_version": "3.4.8+dfsg0-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "tinymce",
        "purl": "pkg:deb/ubuntu/tinymce@3.4.8+dfsg0-2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.4.8+dfsg0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "tinymce",
            "binary_version": "3.4.8+dfsg0-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "tinymce",
        "purl": "pkg:deb/ubuntu/tinymce@3.4.8+dfsg0-2?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.4.8+dfsg0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.",
  "id": "UBUNTU-CVE-2026-47761",
  "modified": "2026-06-03T11:26:15Z",
  "published": "2026-05-28T16:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-47761"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47761"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w"
    },
    {
      "type": "REPORT",
      "url": "https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview"
    },
    {
      "type": "REPORT",
      "url": "https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-47761"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-47761 (GCVE-0-2026-47761)

CLEANSTART-2026-LJ04584 (CVE-2026-47761)

CLEANSTART-2026-NU98727 (CVE-2026-8723)

FKIE_CVE-2026-47761

GHSA-VG35-5WQ7-3X7W

Impact

Patches

Workarounds

Fix

Acknowledgements

UBUNTU-CVE-2026-47761 (CVE-2026-47761)

Tags

Sightings

Nomenclature

Related by attack behaviour