{"id":"CVE-2026-116675","kind":"vulnerability","aliases":["CVE-2026-116675"],"related":[],"title":"TinyMCE: media plugin lets crafted content run scripts, stored XSS","description":"TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.","summary":"TinyMCE's media plugin creates elements from crafted data-mce-object attributes before sanitization, so malicious scripts can run while content is processed. An attacker who can store content in an editor field gets stored cross-site scripting for users who have the media plugin enabled.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","frontend","javascript","package","tinymce"],"not_affected_if":["media-plugin-disabled","other-version"],"how_to_check":"- Check the installed TinyMCE version in your package manifest or lockfile (for example `npm ls tinymce`); affected lines are `7.9.3` to before `7.9.4` and `8.5.1` to before `8.9.3`.\n- Check whether the media plugin is loaded in your editor configuration (the `plugins` list includes `media`).","fix":"- Upgrade TinyMCE 8.x to `8.9.3` or later.\n- Upgrade TinyMCE 7.x to `7.9.4` or later.","status":"open","published_at":"2026-10-27T17:16:59+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:34:27+00:00","updated_at":"2026-10-27T17:34:27+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T17:34:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade TinyMCE 8.x to `8.9.3` or later.\n- Upgrade TinyMCE 7.x to `7.9.4` or later.","reach":"internet","title":"TinyMCE: media plugin lets crafted content run scripts, stored XSS","impact":"medium","summary":"TinyMCE's media plugin creates elements from crafted data-mce-object attributes before sanitization, so malicious scripts can run while content is processed. An attacker who can store content in an editor field gets stored cross-site scripting for users who have the media plugin enabled.","category":"package","nicknames":[],"who_cares":["tinymce","javascript","frontend","cms"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Malicious scripts run in other users' browsers via stored content.","analyst_note":"","how_to_check":"- Check the installed TinyMCE version in your package manifest or lockfile (for example `npm ls tinymce`); affected lines are `7.9.3` to before `7.9.4` and `8.5.1` to before `8.9.3`.\n- Check whether the media plugin is loaded in your editor configuration (the `plugins` list includes `media`).","needs_analyst":false,"not_affected_if":["media-plugin-disabled","other-version"],"who_is_affected":"Sites that run TinyMCE 7.9.3 to before 7.9.4 or 8.5.1 to before 8.9.3 with the media plugin enabled are exposed, especially where editor content is stored and shown to other users. Teams on other TinyMCE versions, or with the media plugin disabled, can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000632,"input_tokens":3339,"output_tokens":596,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116675':13A,16A '-2026':12A,15A '7.9.3':79C '7.9.4':81C,134C '8.5.1':84C '8.9.3':86C,132C 'activ':100C 'attack':47B 'attribut':34B 'cms':17B 'content':6A,43B,51B 'craft':5A,29B,92C 'creat':26B,90C 'cross':59B,116C 'cross-sit':58B,115C 'cve':11A,14A 'data':31B,95C 'data-mce-object':30B,94C 'document':101C 'editor':54B,77C 'element':27B,91C,105C 'enabl':69B,125C 'execut':107C 'field':55B 'fix':129C 'frontend':18B 'get':56B 'issu':127C 'javascript':19B 'let':4A 'malici':38B,108C 'mce':32B,96C 'media':2A,24B,67B,88C,123C 'object':33B,97C 'open':73C 'packag':20B 'plugin':3A,25B,68B,89C,124C 'process':45B,111C 'result':112C 'rich':75C 'run':7A,41B 'sanit':36B,103C 'script':8A,39B,61B,109C,118C 'site':60B,117C 'sourc':74C 'store':9A,50B,57B,114C 'text':76C 'tinymc':1A,21B,22B,70C 'user':63B,120C 'version':131C 'xss':10A","nicknames":[],"mitigations":[],"who_affected":"Sites that run TinyMCE 7.9.3 to before 7.9.4 or 8.5.1 to before 8.9.3 with the media plugin enabled are exposed, especially where editor content is stored and shown to other users. Teams on other TinyMCE versions, or with the media plugin disabled, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116675","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116675","severity":null,"published_at":"2026-10-27T17:16:59+00:00","modified_at":"2026-10-27T17:16:59+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}