TinyMCE EUVD-2026-111106

Exploitation requires the TinyMCE media plugin to be enabled (not every deployment enables it) and an affected version (7.9.3, or 8.5.1 through 8.9.2). The attacker must be able to inject editor content - consistent with PR:L, an authenticated low-privileged content author - using a crafted span bearing data-mce-object plus a data-mce-p-<event> handler attribute (the fix tests use onerror on video/audio/img). Because the stored payload executes when the content is processed/rendered, a victim interaction is needed (UI:P). Limiting factors that reduce realistic risk: the media plugin must be active, the attacker needs authenticated content-submission access, and another user must process the malicious content; installations on 7.9.4 / 8.9.3+ or without the media plugin are not exposed.

This is a genuine but conditional priority rather than a top-tier emergency. The CVSS 4.0 base score of 8.5 reflects high confidentiality and integrity impact (VC:H/VI:H) over a network vector with low complexity, but two metrics meaningfully constrain real-world risk: PR:L means the attacker must be an authenticated low-privileged user able to submit content, and UI:P means a victim must process/render that content. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a serious-but-not-panic posture. No CISA KEV listing and no EPSS score were provided, so there is no signal of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis,' though note the vendor's own fix commit publicly includes the exact triggering payload (a span with data-mce-object and a data-mce-p-onerror event handler), which effectively demonstrates the trigger even if no standalone weaponized exploit is cataloged. The dominant risk driver is TinyMCE's very broad deployment as an embedded editor, not any evidence of mass exploitation; this reads as a widely-applicable stored-XSS fix to roll out promptly in affected 7.9.3 and 8.5.1-8.9.2 installs that have the media plugin enabled.

An authenticated low-privileged user of a web application embedding a vulnerable TinyMCE (media plugin enabled) submits content containing a crafted span using data-mce-object with a data-mce-p-onerror event-handler attribute (e.g. for a video/audio/img element). When the editor processes this content, the element is created in the active document before sanitization, so the event handler fires and runs attacker script in another user's browser session. No standalone public exploit is cataloged, but the vendor's fix commit discloses working trigger payloads in its test cases.