CVE-2026-47761

תיאור (מקור, אנגלית)

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

מדדים

CVSS 3.1

5.4 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-6/8/2026

CWE

CWE-79

מוצרים מושפעים

tiny: tinymce

קישורים

• https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w PatchVendor Advisory
• https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview Release Notes
• https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview Release Notes