Live › vulnerability › CVE-2026-116675
Go to dashboardTinyMCE's media plugin creates elements from crafted data-mce-object attributes before sanitization, so malicious scripts can run while content is processed. An attacker who can store content in an editor field gets stored cross-site scripting for users who have the media plugin enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Sites that run TinyMCE 7.9.3 to before 7.9.4 or 8.5.1 to before 8.9.3 with the media plugin enabled are exposed, especially where editor content is stored and shown to other users. Teams on other TinyMCE versions, or with the media plugin disabled, can skip it.
No product ranges from the sources yet.
npm ls tinymce); affected lines are 7.9.3 to before 7.9.4 and 8.5.1 to before 8.9.3.plugins list includes media).8.9.3 or later.7.9.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-116675")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.