TinyMCE EUVD-2026-32921

Attacker must hold an authenticated account with permission to submit content through a TinyMCE-backed editor (PR:L), the host application must store and later re-render that content using TinyMCE's serializer without an external sanitizer stripping data-mce-* attributes, and a second user must view the rendered output (UI:R) for the payload to execute in their browser. Exploitation is limited where the host application post-processes editor output with DOMPurify or an equivalent allowlist sanitizer that drops data-mce-href, data-mce-src, and data-mce-style, where editor access is restricted to fully trusted users, or where the deployment has already upgraded to 5.11.1, 7.9.3, or 8.5.1. No special non-default TinyMCE configuration is required - the vulnerability is in the default serialization path for the affected attributes.

The CVSS 8.7 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) is elevated primarily by Scope:Changed - exploitation in the editor crosses into the browsing context of other application users - combined with low attack complexity and only low privileges required. UI:R indicates a victim must view the malicious content, which is realistic in CMS, mail, and collaboration workflows where stored editor output is rendered to many users. EPSS data and CISA KEV status are not provided in the input, and no public exploit identified at time of analysis; however, TinyMCE's enormous deployment surface and the typical pattern of XSS PoCs being published shortly after coordinated disclosure mean defenders should treat this as a near-term priority rather than a theoretical high score. No conflicting signals were observed between the description and CVSS vector.

An authenticated low-privilege user (forum poster, blog contributor, helpdesk ticket submitter) crafts HTML containing benign-looking elements but with malicious data-mce-href or data-mce-style values; TinyMCE's serializer overwrites the validated attributes with the attacker's payload when the content is saved. When an administrator or other user later views the stored content in their browser, the injected script executes in their session context, enabling cookie theft, CSRF against privileged endpoints, or account takeover. No public exploit identified at time of analysis, but the GHSA advisory describes the mechanism in enough detail to support proof-of-concept development.