8.7 HighCWE-79
CVE-2026-47762
tinymce vulnerability
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 23 Oct
0.3%probability of exploitation in the next 30 days
Higher than 20% of scored CVEs
SeverityCVSS
8.7High
Description NVD
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.
Coverage 1 article · 1 outlet
- TinyMCE Flaws Allow Remote Script Injection, Patches UrgedSecurityOnline · first in our coverage · mentions it in passing