CVE-2026-116675 — Vulnerability intelligence
PHP / Composer — tinymce, TinyMCE, tinymce/tinymce, tinymce, TinyMCE, tinymce/tinymce
Published:
- CVSS
- 0
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
### Impact
Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled.
### Patches
This vulnerability has been patched in TinyMCE 8.9.3 and TinyMCE 7.9.4 by ensuring that, when using the media plugin, any content created through the data-mce-object attribute is properly sanitized first.
### Workarounds
No official workaround available.
### Fix
To avoid this vulnerability:
Upgrade to TinyMCE 8.9.3 or higher.
Upgrade to TinyMCE 7.9.4 or higher.
### Acknowledgements
Tiny thanks [Fariskhi Vidyan](https://github.com/farisv) and David Vieira Kurz (HiSolutions AG) for their help identifying this vulnerability.