TinyMCE: Stored cross-site scripting in media plugin (CVE-2026-116675)
TinyMCE is vulnerable to stored Cross-Site Scripting (XSS) via the media plugin, allowing attackers to inject malicious scripts through the data-mce-object attribute before sanitization occurs.
CVE search metadata
CVE search record: CVE-2026-116675. KEV: no. Product: TinyMCE (>= 8.5.1, < 8.9.3), TinyMCE (7.9.3). Brief: TinyMCE: Stored cross-site scripting in media plugin (CVE-2026-116675). Brief link: https://feed.craftedsignal.io/briefs/2026-10-tinymce-xss/
Triage facts
Revision 1- Applicability
- TinyMCE (>= 8.5.1, < 8.9.3), TinyMCE (7.9.3)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 23:58 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
TinyMCE versions 8.5.1 up to 8.9.2 and 7.9.3 are vulnerable to a stored XSS vulnerability within the media plugin. An attacker can craft inputs using the 'data-mce-object' attribute that the editor fails to sanitize before execution, leading to potential script execution in the context of the user's session.
Impact
Successful exploitation results in stored Cross-Site Scripting. This allows attackers to execute arbitrary JavaScript in the browser of any user who views the affected content within the TinyMCE editor.
Recommendation
- Upgrade TinyMCE to version 8.9.3 or higher.
- Upgrade TinyMCE to version 7.9.4 or higher.
- Audit existing content stored via the media plugin if the application is highly targeted.
Threat Hunt
Inspect application database for data-mce-object attributes containing anomalous script tags or event handlers
Data: Application database content, Web application logs
Mitigations
Upgrade TinyMCE instances to 8.9.3 or 7.9.4
CVE-2026-116675