TinyMCE EUVD-2026-32923

Exploitation requires that the target application enables TinyMCE's 'protect' configuration option (a non-default code-preservation feature typically used to shield server-side templating tags like PHP/ASP), that the attacker has a low-privileged account capable of submitting content into a TinyMCE-managed field (PR:L per the CVSS vector), and that a victim subsequently loads or restores the stored content into a TinyMCE-rendered context (UI:R). Limiting factors that reduce real-world exposure: deployments that do not use the protect option are not vulnerable, fully anonymous content submission is not assumed by the vector, and the payload only fires when content is restored through the editor rather than on any arbitrary page render.

Signals are mixed but lean toward a real priority for any application that exposes TinyMCE with the protect option enabled. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N indicates network reach, low complexity, low privileges, and required user interaction, with a changed scope reflecting that XSS executes in the victim's browser context outside the vulnerable component - driving the 8.7 score. PR:L means the attacker must hold at least a low-privileged account (typical for a content-author or commenter role), and UI:R means a victim must view/load the stored content. EPSS data was not provided in the input, so likelihood of broad exploitation cannot be quantified; the vulnerability is not in CISA KEV and no public PoC is referenced beyond the vendor advisory, so this should be treated as no public exploit identified at time of analysis. The realistic risk is highest for multi-tenant SaaS and CMS deployments where attacker-controlled content is rendered to higher-privileged users (e.g., admins reviewing submissions), enabling session hijack or admin account takeover through the scope-changed XSS.

An attacker with a low-privileged authoring account on a CMS that embeds a vulnerable TinyMCE version with the protect option enabled submits a forum post, comment, or page draft containing a forged mce:protected comment wrapping a script payload. When an administrator or another user later opens the stored content in the editor (or in a view that uses TinyMCE to restore content), the smuggled JavaScript executes in the victim's session, enabling cookie theft, CSRF against admin endpoints, or full account takeover. No public PoC is referenced beyond the vendor advisory at the time of analysis.