Vulnerability Directory | CVE-2026-47761

Overview

TinyMCE is a popular open-source, web-based rich text editor (WYSIWYG) that allows developers to embed an editable content area into web applications. It converts HTML elements into editable regions and provides a wide range of formatting, content insertion, and plugin capabilities.

A high-severity stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-47761) has been identified in TinyMCE's media plugin. With the media plugin enabled, TinyMCE trusts internal-looking placeholder attributes such as data-mce-object and data-mce-p-*. A crafted placeholder using data-mce-object together with a data-mce-p-onclick attribute is unprefixed by the media plugin during serialization into a real onclick attribute, so attacker-controlled JavaScript executes when the stored output is rendered and interacted with.

Per OWASP, Cross-Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected into otherwise benign and trusted websites; they occur when an attacker uses a web application to send malicious code, generally in the form of a browser-side script, to a different end user.

Details

Module Info

Product: TinyMCE
Affected packages: tinymce
Affected versions: <5.11.1, >=6.0.0 <7.9.3, >=8.0.0 <8.5.1
GitHub repository: https://github.com/tinymce/tinymce
Published packages: https://www.npmjs.com/package/tinymce
Package manager: npm
Fixed in:
OSS v7.9.3
OSS v8.5.1
NES for TinyMCE v6.8.9

Vulnerability Info

This high-severity vulnerability allows stored XSS for users of TinyMCE with the media plugin enabled.

The media plugin represents embedded media as placeholder elements that carry internal data-mce-object and data-mce-p-* attributes describing the real media element and its attributes. When serializing content, the plugin reconstructs the media element from these placeholder attributes, unprefixing each data-mce-p-* attribute into a live attribute. Because the placeholder attributes are trusted without sanitization, an attacker can smuggle an event handler such as data-mce-p-onclick that becomes a real onclick attribute on the reconstructed element.

This vulnerability could be exploited by:

crafting a placeholder element with data-mce-object and malicious data-mce-p-* attributes (for example data-mce-p-onclick)
having TinyMCE serialize the content so the prefixed attributes are unprefixed into live event handlers
storing the output so the injected handler executes when the content is rendered and clicked

The upstream fix ensures that media placeholder data-mce-object reconstruction is properly sanitized before placeholders are replaced with real media elements.