TinyMCE EUVD-2026-32922

Requires the TinyMCE media plugin to be enabled in the deployed editor configuration (it is a non-default plugin that must be explicitly added to the plugins list). The attacker must hold a low-privileged authenticated account on the host application with permission to author or edit content via TinyMCE (PR:L). Exploitation also requires user interaction (UI:R) - a victim must subsequently render or view the attacker-stored content for the injected script to fire. Limiting factors: deployments that have not enabled the media plugin, that sanitize output server-side before rendering, or that enforce a strict CSP forbidding inline script execution are not exploitable via this vector.

The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N yields 8.7 - elevated by scope change (S:C), reflecting that injected script executes in a different security context (a victim's browser session) than the authoring component. Exploitation requires low-privilege authentication (PR:L - any user with editor access) and user interaction (UI:R - a victim must view the malicious content), which moderates real-world risk versus a pre-auth RCE. The vulnerability is not listed in CISA KEV and no public exploit identified at time of analysis, and no EPSS score was supplied in the input. Stored XSS in editor components is historically attractive to attackers targeting admin sessions in multi-tenant CMS deployments, so while this is not a drop-everything emergency, it warrants prompt patching anywhere untrusted users can author content rendered to higher-privileged viewers. EPSS data is missing from the input, so probabilistic exploitation likelihood cannot be quantified here.

An attacker with low-privilege editor access (e.g., a contributor account on a CMS using TinyMCE) crafts a media element whose data-mce-* attribute contains a JavaScript payload, then saves the content. When an administrator or other privileged user later views the page or returns to edit the content, the script executes in their browser context, enabling session hijacking, CSRF against the admin panel, or exfiltration of sensitive page data. No public exploit identified at time of analysis, but the attack pattern is well-understood and trivially reproducible given the public advisory.