TinyMCE
The best WYSIWYG editor! TinyMCE is a platform independent web based Javascript HTML WYSIWYG editor control released as Open Source under GNU General Public License Version 2 or later by Tiny Technologies, Inc. TinyMCE has the ability to convert HTML TEXTAREA fields or other HTML elements to editor instances. TinyMCE is very easy to integrate into other Content Management Systems.
Activity
- Latest release
- 6d ago
- Total releases
- 254
- Cadence
- ~14 days
- Last 12 months
- 18
Details
- License
- unknown
- First release
- Aug 03, 2011
| Version | Released | |
|---|---|---|
8.9.1
patch
|
8.9.1
patch
|
|
8.9.0
minor
|
8.9.0
minor
|
|
8.8.2
patch
|
8.8.2
patch
|
|
8.8.1
patch
|
8.8.1
patch
|
|
8.8.0
minor
|
8.8.0
minor
|
|
8.7.0
minor
|
8.7.0
minor
|
|
8.6.0
minor
|
8.6.0
minor
|
|
8.5.1
patch
|
8.5.1
patch
|
|
7.9.3
patch
|
7.9.3
patch
|
|
8.5.0
minor
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.5.0
minor
|
|
8.4.0
minor
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.4.0
minor
|
|
7.9.2
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.9.2
patch
|
|
8.3.2
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.3.2
patch
|
|
8.3.1
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.3.1
patch
|
|
8.3.0
minor
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.3.0
minor
|
|
8.2.2
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.2.2
patch
|
|
8.2.1
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.2.1
patch
|
|
8.2.0
minor
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.2.0
minor
|
|
8.1.2
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.1.2
patch
|
|
8.1.1
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.1.1
patch
|
|
8.1.0
minor
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.1.0
minor
|
|
8.0.2
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.0.2
patch
|
|
8.0.1
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.0.1
patch
|
|
8.0.0
major
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
8.0.0
major
|
|
6.8.6
patch
5 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47760
GHSA-mh5m-5hw4-5c69
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactTinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. PatchesThis issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later. WorkaroundsNo official workaround available. AcknowledgementsTiny thanks maple3142 (https://maple3142.net) of DEVCORE for their help identifying this vulnerability. ReferencesFix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability. Affected versions
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
Fixed in
7.1.0
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-29881
GHSA-5359-pvf2-pw78
Mar 26, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
4.3
/ 10
Medium
Network
Low
None
Required
Unchanged
Low
None
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an FixTinyMCE 6.8.1 introduced a new WorkaroundsIf you are using TinyMCE 6.8.1 or higher, set AcknowledgementsTiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability. ReferencesAffected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 198 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
Fixed in
7.0.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.8.6
patch
|
|
7.9.1
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.9.1
patch
|
|
7.9.0
minor
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.9.0
minor
|
|
7.8.0
minor
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.8.0
minor
|
|
7.7.2
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.7.2
patch
|
|
7.7.1
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.7.1
patch
|
|
7.7.0
minor
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.7.0
minor
|
|
7.6.1
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.6.1
patch
|
|
7.6.0
minor
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.6.0
minor
|
|
7.5.1
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.5.1
patch
|
|
7.5.0
minor
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.5.0
minor
|
|
6.8.5
patch
5 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47760
GHSA-mh5m-5hw4-5c69
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactTinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. PatchesThis issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later. WorkaroundsNo official workaround available. AcknowledgementsTiny thanks maple3142 (https://maple3142.net) of DEVCORE for their help identifying this vulnerability. ReferencesFix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability. Affected versions
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
Fixed in
7.1.0
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-29881
GHSA-5359-pvf2-pw78
Mar 26, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
4.3
/ 10
Medium
Network
Low
None
Required
Unchanged
Low
None
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an FixTinyMCE 6.8.1 introduced a new WorkaroundsIf you are using TinyMCE 6.8.1 or higher, set AcknowledgementsTiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability. ReferencesAffected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 198 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
Fixed in
7.0.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.8.5
patch
|
|
7.4.1
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.4.1
patch
|
|
7.4.0
minor
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.4.0
minor
|
|
7.3.0
minor
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.3.0
minor
|
|
7.2.1
patch
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.2.1
patch
|
|
6.8.4
patch
5 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47760
GHSA-mh5m-5hw4-5c69
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactTinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. PatchesThis issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later. WorkaroundsNo official workaround available. AcknowledgementsTiny thanks maple3142 (https://maple3142.net) of DEVCORE for their help identifying this vulnerability. ReferencesFix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability. Affected versions
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
Fixed in
7.1.0
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-29881
GHSA-5359-pvf2-pw78
Mar 26, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
4.3
/ 10
Medium
Network
Low
None
Required
Unchanged
Low
None
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an FixTinyMCE 6.8.1 introduced a new WorkaroundsIf you are using TinyMCE 6.8.1 or higher, set AcknowledgementsTiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability. ReferencesAffected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 198 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
Fixed in
7.0.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.8.4
patch
|
|
7.2.0
minor
3 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev |
7.2.0
minor
|
|
7.1.2
patch
5 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38356
GHSA-9hcv-j9pv-qmph
PYSEC-2026-1301
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the FixTo avoid this vulnerability:
ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38357
GHSA-w9jx-4g6g-rp7x
PYSEC-2026-1302
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Malav Khatri and another reporter for their help identifying this vulnerability. ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
7.1.2
patch
|
|
7.1.1
patch
5 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38356
GHSA-9hcv-j9pv-qmph
PYSEC-2026-1301
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the FixTo avoid this vulnerability:
ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38357
GHSA-w9jx-4g6g-rp7x
PYSEC-2026-1302
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Malav Khatri and another reporter for their help identifying this vulnerability. ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
7.1.1
patch
|
|
7.1.0
minor
5 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38356
GHSA-9hcv-j9pv-qmph
PYSEC-2026-1301
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the FixTo avoid this vulnerability:
ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38357
GHSA-w9jx-4g6g-rp7x
PYSEC-2026-1302
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Malav Khatri and another reporter for their help identifying this vulnerability. ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
7.1.0
minor
|
|
7.0.1
patch
6 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47760
GHSA-mh5m-5hw4-5c69
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactTinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. PatchesThis issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later. WorkaroundsNo official workaround available. AcknowledgementsTiny thanks maple3142 (https://maple3142.net) of DEVCORE for their help identifying this vulnerability. ReferencesFix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability. Affected versions
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
Fixed in
7.1.0
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38356
GHSA-9hcv-j9pv-qmph
PYSEC-2026-1301
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the FixTo avoid this vulnerability:
ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38357
GHSA-w9jx-4g6g-rp7x
PYSEC-2026-1302
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Malav Khatri and another reporter for their help identifying this vulnerability. ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
7.0.1
patch
|
|
7.0.0
major
6 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47760
GHSA-mh5m-5hw4-5c69
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactTinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. PatchesThis issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later. WorkaroundsNo official workaround available. AcknowledgementsTiny thanks maple3142 (https://maple3142.net) of DEVCORE for their help identifying this vulnerability. ReferencesFix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability. Affected versions
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
Fixed in
7.1.0
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38356
GHSA-9hcv-j9pv-qmph
PYSEC-2026-1301
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the FixTo avoid this vulnerability:
ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38357
GHSA-w9jx-4g6g-rp7x
PYSEC-2026-1302
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Malav Khatri and another reporter for their help identifying this vulnerability. ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
7.0.0
major
|
|
6.8.3
patch
7 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47760
GHSA-mh5m-5hw4-5c69
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactTinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. PatchesThis issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later. WorkaroundsNo official workaround available. AcknowledgementsTiny thanks maple3142 (https://maple3142.net) of DEVCORE for their help identifying this vulnerability. ReferencesFix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability. Affected versions
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
Fixed in
7.1.0
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38356
GHSA-9hcv-j9pv-qmph
PYSEC-2026-1301
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the FixTo avoid this vulnerability:
ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38357
GHSA-w9jx-4g6g-rp7x
PYSEC-2026-1302
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Malav Khatri and another reporter for their help identifying this vulnerability. ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-29881
GHSA-5359-pvf2-pw78
Mar 26, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
4.3
/ 10
Medium
Network
Low
None
Required
Unchanged
Low
None
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an FixTinyMCE 6.8.1 introduced a new WorkaroundsIf you are using TinyMCE 6.8.1 or higher, set AcknowledgementsTiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability. ReferencesAffected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 198 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
Fixed in
7.0.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.8.3
patch
|
|
6.8.2
patch
7 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47760
GHSA-mh5m-5hw4-5c69
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactTinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. PatchesThis issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later. WorkaroundsNo official workaround available. AcknowledgementsTiny thanks maple3142 (https://maple3142.net) of DEVCORE for their help identifying this vulnerability. ReferencesFix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability. Affected versions
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
Fixed in
7.1.0
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38356
GHSA-9hcv-j9pv-qmph
PYSEC-2026-1301
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the FixTo avoid this vulnerability:
ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38357
GHSA-w9jx-4g6g-rp7x
PYSEC-2026-1302
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Malav Khatri and another reporter for their help identifying this vulnerability. ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-29881
GHSA-5359-pvf2-pw78
Mar 26, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
4.3
/ 10
Medium
Network
Low
None
Required
Unchanged
Low
None
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an FixTinyMCE 6.8.1 introduced a new WorkaroundsIf you are using TinyMCE 6.8.1 or higher, set AcknowledgementsTiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability. ReferencesAffected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 198 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
Fixed in
7.0.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.8.2
patch
|
|
6.8.1
patch
7 CVEs
CVE-2026-47761
GHSA-vg35-5wq7-3x7w
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted PatchesThis vulnerability has been patched in TinyMCE 8.5.1, TinyMCE 7.9.3 and TinyMCE 5.11.1 LTS by ensuring that, when using the media plugin, any content with WorkaroundsNo official workaround available. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Aymane MAZGUITI and Ange Primiterra for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47762
GHSA-v98h-vmpc-fpqv
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. PatchesPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version. WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Jul 15, 2026 · Source: OSV.dev
CVE-2026-47759
GHSA-q742-qvgc-gc2f
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactStored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. PatchesPatched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x). WorkaroundsNo official workaround available. FixTo avoid this vulnerability: Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract). AcknowledgementsTiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability. Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 233 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
7.2.0
7.2.1
7.3.0
7.4.0
7.4.1
7.5.0
7.5.1
7.6.0
7.6.1
7.7.0
7.7.1
7.7.2
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.1
8.0.2
8.1.0
8.1.1
8.1.2
8.2.0
8.2.1
8.2.2
8.3.0
8.3.1
8.3.2
8.4.0
8.5.0
Fixed in
7.9.3
8.5.1
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2026-47760
GHSA-mh5m-5hw4-5c69
Jun 05, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
8.7
/ 10
High
Network
Low
Low
Required
Changed
High
High
None
ImpactTinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. PatchesThis issue affects TinyMCE 6.8.x-7.0.x. The vulnerability is fixed in TinyMCE 7.1.0 and later. WorkaroundsNo official workaround available. AcknowledgementsTiny thanks maple3142 (https://maple3142.net) of DEVCORE for their help identifying this vulnerability. ReferencesFix introduced in TinyMCE 7.1.0 though a rewrite of code causing the vulnerability. Affected versions
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
7.0.0
7.0.1
Fixed in
7.1.0
References Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38356
GHSA-9hcv-j9pv-qmph
PYSEC-2026-1301
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the FixTo avoid this vulnerability:
ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-38357
GHSA-w9jx-4g6g-rp7x
PYSEC-2026-1302
Jun 19, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Medium
Network
Low
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. PatchesThis vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. FixTo avoid this vulnerability:
AcknowledgementsTiny thanks Malav Khatri and another reporter for their help identifying this vulnerability. ReferencesFor more informationIf you have any questions or comments about this advisory:
Affected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 200 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
7.0.0
7.0.1
7.1.0
7.1.1
7.1.2
Fixed in
5.11.0
6.8.4
7.2.0
References
Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-29881
GHSA-5359-pvf2-pw78
Mar 26, 2024
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
4.3
/ 10
Medium
Network
Low
None
Required
Unchanged
Low
None
None
ImpactA cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an FixTinyMCE 6.8.1 introduced a new WorkaroundsIf you are using TinyMCE 6.8.1 or higher, set AcknowledgementsTiny Technologies would like to thank Toni Huttunen of Fraktal Oy for discovering this vulnerability. ReferencesAffected versions
3.4.3.2
3.4.4
3.4.5
3.4.7
3.5.0
3.5.0.1
3.5.1
3.5.1.1
3.5.2
3.5.3
3.5.4
3.5.4.1
+ 198 more Show less
3.5.5
3.5.6
3.5.7
3.5.8
4.0.0
4.0.1
4.0.10
4.0.11
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.2
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.25
4.0.26
4.0.27
4.0.28
4.0.4
4.0.5
4.0.6
4.0.8
4.0.9
4.1.0
4.1.1
4.1.10
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.2.8
4.3.0
4.3.1
4.3.10
4.3.11
4.3.12
4.3.13
4.3.2
4.3.3
4.3.4
4.3.6
4.3.7
4.3.8
4.3.9
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.6.0
4.6.1
4.6.2
4.6.3
4.6.4
4.6.5
4.6.6
4.6.7
4.7.0
4.7.10
4.7.11
4.7.12
4.7.13
4.7.3
4.7.4
4.7.5
4.7.6
4.7.7
4.7.8
4.7.9
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.10
4.9.11
4.9.2
4.9.3
4.9.4
4.9.5
4.9.6
4.9.7
4.9.8
4.9.9
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.10.0
5.10.1
5.10.2
5.10.3
5.10.4
5.10.5
5.10.6
5.10.7
5.10.8
5.10.9
5.2.0
5.2.1
5.2.2
5.3.0
5.3.1
5.3.2
5.4.0
5.4.1
5.4.2
5.5.0
5.5.1
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.8.0
5.8.1
5.8.2
5.9.0
5.9.1
5.9.2
6.0.0
6.0.1
6.0.2
6.0.3
6.1.0
6.1.1
6.1.2
6.2.0
6.3.0
6.3.1
6.3.2
6.4.0
6.4.1
6.4.2
6.5.0
6.5.1
6.6.2
6.7.0
6.7.1
6.7.2
6.7.3
6.8.0
6.8.1
6.8.2
6.8.3
6.8.4
6.8.5
6.8.6
Fixed in
7.0.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
6.8.1
patch
|