{"id":"CVE-2026-47761","summary":"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection","details":"TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.","aliases":["GHSA-vg35-5wq7-3x7w"],"modified":"2026-07-11T03:53:21.477785368Z","published":"2026-05-28T15:20:57.814Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47761.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"5.11.1"}]}]},"references":[{"type":"WEB","url":"https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview"},{"type":"WEB","url":"https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47761.json"},{"type":"ADVISORY","url":"https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47761"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tinymce/tinymce","events":[{"introduced":"4cc623897917472ba418f1378170727d7a94575b"},{"fixed":"9dac5bb3c875b9c5de43a3f6ea33f55437e77325"},{"introduced":"9f7ab4d2acef062e7f2cd85e7498e3016446ff65"},{"fixed":"03573dd3ca7ac79f79b8f6e66f3b4256d3e1de36"}],"database_specific":{"extracted_events":[{"introduced":"6.0.0"},{"fixed":"7.9.3"},{"introduced":"8.0.0"},{"fixed":"8.5.1"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-47761.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"}]}