TinyMCE EUVD-2026-32920

Exploitation requires (1) a target application that embeds TinyMCE between 6.8.0 and 7.0.x and relies on the editor's built-in sanitizer rather than an additional server-side sanitization layer, (2) an attacker account with permission to submit editor content (PR:L), (3) a victim with an authenticated session who views or previews the attacker-supplied content in a browser (UI:R), and (4) the application must allow SVG markup to survive into the rendered output - deployments that already strip svg/foreignObject tags server-side are not exploitable. The scope change (S:C) means the impact lands on the hosting application's origin, not on TinyMCE itself, so the realistic blast radius depends on what privileges the victim's session holds in that hosting app.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N yields 8.7 (High), driven primarily by the scope change (S:C) - the editor sanitizes content that is later rendered in the parent application, so a successful XSS pivots into the hosting site's origin and impacts other users. PR:L means a low-privilege account that can submit editor content is sufficient, and UI:R reflects that a victim must view the malicious content. There is no EPSS score, KEV listing, or POC reference in the supplied intelligence, so real-world risk is currently theoretical but elevated by TinyMCE's massive install base and the fact that the GHSA advisory provides enough detail for a competent researcher to reproduce. No conflicting signals were observed between the CVSS vector and the description; both consistently describe an authenticated, user-interaction-dependent client-side attack.

An attacker with a low-privilege account on a CMS, helpdesk, or collaboration platform that embeds vulnerable TinyMCE composes a comment or article containing a crafted SVG payload with nested elements that smuggle an event-handler attribute past the sanitizer. The malicious content is stored and later rendered to a moderator or administrator who views the page, triggering JavaScript execution in the host application's origin and enabling session theft, CSRF token exfiltration, or privilege escalation through admin-only API calls.