Vulnerability intelligence

CVE-2026-47762

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

CVSS Score

8.7

High

EPSS — Exploit Probability

0.3%

Riskier than 20% of all CVEs · checked 2026-09-05

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published