What is the CVSS score of CVE-2026-47759?

CVE-2026-47759 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of TinyMCE are affected by CVE-2026-47759?

A stored cross-site scripting vulnerability in TinyMCE rich text editor allows authenticated users to inject malicious code that executes when other users view the affected content, creating risk of…. A patch is available.

How to fix or mitigate CVE-2026-47759?

Within 24 hours: Inventory all TinyMCE installations and identify current versions in use. Within 7 days: Implement input validation and sanitization on all user-controlled TinyMCE content, apply strict output encoding when rendering, and deploy Content Security Policy (CSP) with script-src restrictions. Within 30 days: Monitor TinyMCE vendor releases for patched versions 5.11.1, 7.9.3, and 8.5.1; prepare and test upgrade procedures in non-production environment.

TinyMCE CVE-2026-47759

EUVD-2026-32921 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-28 GitHub_M

GHSA-q742-qvgc-gc2f

XSS Tinymce

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 28, 2026 - 17:01 EUVD

Analysis Generated

May 28, 2026 - 15:52 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on tinymce (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.0.0.

DescriptionGitHub Advisory

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

AnalysisAI

Stored cross-site scripting in TinyMCE rich text editor versions prior to 5.11.1, 7.9.3, and 8.5.1 allows authenticated attackers to inject malicious payloads via unsanitized data-mce-href, data-mce-src, and data-mce-style attributes that override safe attributes during serialization. The scope-changing CVSS 8.7 score reflects that successful exploitation impacts other users viewing the rendered content, and no public exploit identified at time of analysis though the upstream GitHub advisory provides technical detail useful to researchers.

Technical ContextAI

TinyMCE is a widely embedded open-source WYSIWYG rich text editor (cpe:2.3:a:tinymce:tinymce) used in CMS platforms, webmail, ticketing systems, and SaaS applications. The flaw is a CWE-79 Improper Neutralization of Input During Web Page Generation in the serialization layer: TinyMCE uses internal data-mce-* shadow attributes (data-mce-href, data-mce-src, data-mce-style) to preserve original author input alongside sanitized public attributes. Because these shadow attributes were not themselves sanitized, attacker-controlled values are written back over the validated href/src/style during HTML serialization, defeating the editor's built-in XSS filtering.

RemediationAI

Vendor-released patch: upgrade TinyMCE to 5.11.1, 7.9.3, or 8.5.1 depending on the deployment's major branch, per the GitHub Security Advisory at https://github.com/tinymce/tinymce/security/advisories/GHSA-q742-qvgc-gc2f and the 7.9.3 and 8.5.1 release notes at tiny.cloud. Where immediate upgrade is not feasible, apply a server-side HTML sanitizer such as DOMPurify on stored editor output before rendering and explicitly strip or disallow data-mce-href, data-mce-src, and data-mce-style attributes - the trade-off is that round-tripping content back into the editor may lose formatting fidelity that those shadow attributes preserve. A strict Content-Security-Policy that forbids inline event handlers and unsafe-inline scripts reduces the impact of any residual injection but does not block style-based or javascript: URL vectors on its own. Restrict editor access to trusted authenticated users where business context allows, given exploitation requires PR:L.