---
id: "CVE-2026-111040"
kind: "vulnerability"
aliases: ["CVE-2026-111040"]
title: "Platform: stored HTML injection through TinyMCE editable fields"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "tinymce", "web-app"]
not_affected_if: ["no-untrusted-editors"]
published_at: "2026-11-04T10:17:25+00:00"
first_seen_at: "2026-11-04T10:26:34+00:00"
updated_at: "2026-11-04T10:27:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111040", "first_seen_at": "2026-11-04T10:26:34+00:00"}]
---

# Platform: stored HTML injection through TinyMCE editable fields

An authenticated user with low privileges can store unsanitised HTML in editable fields managed by TinyMCE. That HTML is then rendered in other users' browsers, altering the content they see.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-04T10:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111040

## From the sources

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_