What is the CVSS score of CVE-2026-47761?

CVE-2026-47761 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of TinyMCE are affected by CVE-2026-47761?

TinyMCE, a widely-deployed rich-text editor embedded in content management and publishing platforms, contains a stored cross-site scripting (XSS) vulnerability in its media plugin that allows…. A patch is available.

How to fix or mitigate CVE-2026-47761?

Within 24 hours: Inventory all TinyMCE deployments to identify affected versions (prior to 5.11.1, 7.9.3, or 8.5.1) and confirm media plugin enablement status. Within 7 days: Upgrade to vendor-patched releases (TinyMCE 5.11.1, 7.9.3, or 8.5.1 depending on current branch) after non-production testing; if patching is delayed, disable media plugin functionality or restrict access to trusted administrator accounts only. Within 30 days: Complete production rollout across all environments, review server logs and database records for unauthorized media content injection, and implement stricter input validation on media plugin data attributes.

TinyMCE CVE-2026-47761

EUVD-2026-32922 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-28 GitHub_M

GHSA-vg35-5wq7-3x7w

XSS Tinymce

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 28, 2026 - 17:01 EUVD

Analysis Generated

May 28, 2026 - 15:51 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on tinymce (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.0.0.

DescriptionGitHub Advisory

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

AnalysisAI

Stored cross-site scripting in TinyMCE's media plugin allows authenticated attackers to inject malicious JavaScript via crafted data-mce-* attributes that execute in victim browsers when the rendered content is viewed. Affects TinyMCE versions prior to 5.11.1, 7.9.3, and 8.5.1 where the media plugin is enabled, with no public exploit identified at time of analysis despite a high CVSS score of 8.7 driven by scope change and confidentiality/integrity impact.

Technical ContextAI

TinyMCE is a widely deployed open-source WYSIWYG rich text editor embedded in CMS platforms, web applications, and SaaS products to allow end users to author HTML content. The vulnerability resides in the media plugin, which handles embedded multimedia objects (video, audio, iframes) and relies on data-mce-* attributes to preserve editor-internal state across save/load cycles. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the plugin fails to sanitize attacker-controlled values placed into data-mce-* attributes, allowing script payloads to survive serialization and fire when content is rendered downstream. The affected CPE is cpe:2.3:a:tinymce:tinymce:*:*:*:*:*:*:*:*, covering all TinyMCE distributions integrated into host applications.

RemediationAI

Vendor-released patches are available: upgrade TinyMCE to 5.11.1, 7.9.3, or 8.5.1 (or later) depending on your major-version line, per the GitHub advisory at https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w and the release notes at https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview and https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview. If immediate upgrade is not possible, disable the media plugin in your TinyMCE configuration (remove 'media' from the plugins list) - the trade-off is loss of in-editor video/audio embedding for authors. As a defense-in-depth measure, enforce a strict Content Security Policy on pages rendering TinyMCE output to block inline script execution, and restrict editor access to trusted users only since exploitation requires authenticated content authoring.