Vulnerability Description
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tiny | Tinymce | < 5.11.1 |
Related Weaknesses (CWE)
References
- https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqvVendor Advisory
- https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overviewRelease Notes
- https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overviewRelease Notes
FAQ
What is CVE-2026-47762?
CVE-2026-47762 is a vulnerability with a CVSS score of 8.7 (HIGH). TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject...
How severe is CVE-2026-47762?
CVE-2026-47762 has been rated HIGH with a CVSS base score of 8.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-47762?
Check the references section above for vendor advisories and patch information. Affected products include: Tiny Tinymce.