What is the CVSS score of CVE-2026-47762?

CVE-2026-47762 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of TinyMCE are affected by CVE-2026-47762?

TinyMCE rich text editor versions prior to 5.11.1, 7.9.3, and 8.5.1 contain a stored cross-site scripting vulnerability that allows authenticated users to inject persistent malicious scripts.. A patch is available.

How to fix or mitigate CVE-2026-47762?

24 hours: Inventory all TinyMCE deployments and their versions; identify which instances have the 'protect' configuration option enabled. 7 days: Implement Content Security Policy (CSP) headers to restrict inline script execution; subscribe to TinyMCE security advisories for patch availability updates. 30 days: Develop and test upgrade plan targeting TinyMCE versions 5.11.1, 7.9.3, or 8.5.1 or later; execute patches as soon as vendor releases and approves them.

TinyMCE CVE-2026-47762

EUVD-2026-32923 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-28 GitHub_M

GHSA-v98h-vmpc-fpqv

XSS Tinymce

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 28, 2026 - 17:01 EUVD

Analysis Generated

May 28, 2026 - 15:50 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on tinymce (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.0.0.

DescriptionGitHub Advisory

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

AnalysisAI

Stored cross-site scripting in TinyMCE rich text editor allows authenticated attackers to inject persistent JavaScript by forging mce:protected comments that bypass the editor's sanitization layer. Affected deployments are those using the protect configuration option in versions prior to 5.11.1, 7.9.3, and 8.5.1, where malicious scripts execute when previously stored content is restored into the editor context. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 8.7 (scope-changed) rating reflects high confidentiality and integrity impact against the user's browser session.

Technical ContextAI

TinyMCE is a widely embedded open source WYSIWYG/rich text editor (CPE cpe:2.3:a:tinymce:tinymce) used in CMS platforms, ticketing systems, and SaaS dashboards. The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw rooted in how TinyMCE handles mce:protected comment nodes - a special internal marker used by the 'protect' option to preserve fragments of content (typically server-side templating syntax like PHP or ASP tags) from being mangled by the editor's HTML sanitization. By crafting input that forges this protected-comment wrapper, an attacker can smuggle script content past the sanitizer; the payload is rehydrated and executed when the editor later restores the content into the DOM. The bug is fixed in the 5.11.1, 7.9.3, and 8.5.1 release lines per the GHSA-v98h-vmpc-fpqv advisory.

RemediationAI

Vendor-released patch: upgrade TinyMCE to 5.11.1, 7.9.3, or 8.5.1 (or later) on the corresponding major-version line, as documented in the GHSA-v98h-vmpc-fpqv advisory and the 7.9.3 and 8.5.1 release notes linked above. If immediate upgrade is not possible, disable the 'protect' configuration option in the TinyMCE initialization - note the trade-off that any server-side templating syntax (PHP, ASP, JSP tags) previously shielded by protect will then be subject to the editor's normal HTML processing and may be altered or stripped. As an additional compensating control, enforce a strict Content-Security-Policy that disallows inline script and unsafe-eval on pages that render user-authored TinyMCE content, which limits payload execution at the cost of breaking any legitimate inline scripts in the same documents; and review server-side output sanitization (e.g., DOMPurify on render) to defense-in-depth filter mce:protected comment markers before content is restored.