CVE-2026-116675 in TinyMCE
Summary
by MITRE • 10/27/2026
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified involves TinyMCE, a widely deployed open-source rich text editor used extensively in web applications to facilitate content creation. The specific flaw resides within the media plugin functionality across several version ranges, specifically from versions 7.9.3 up to but not including 7.9.4, and from 8.5.1 up to but not including 8.9.3. This security issue stems from a failure in input validation and sanitization logic during the processing of user-supplied data. When an editor instance with the media plugin enabled processes content containing crafted elements defined via the data-mce-object attribute, these elements are instantiated within the active document prior to the execution of any sanitization routines.
This architectural flaw allows malicious scripts embedded within such attributes to execute in the context of the victim user's browser session. Because the script execution occurs before the security filters can strip or neutralize dangerous content, an attacker who has write access to the editor input can inject persistent malicious code into the stored data. This results in a Stored Cross-Site Scripting vulnerability, which is classified under CWE-79: Improper Neutralization of Input During Web Page Generation commonly known as XSS. The severity of this issue is heightened by its persistence; unlike reflected XSS where the payload must be delivered via a link or specific request context each time, stored XSS remains active in the database and executes every time an authorized user views the compromised content.
The operational impact of this vulnerability allows for significant security compromises depending on the privileges associated with the editor's usage. An attacker can steal session cookies, hijack administrative accounts if they have access to sensitive areas managed through TinyMCE, or perform actions on behalf of the victim such as changing settings or exfiltrating data from connected systems. In environments where multiple users contribute content, this vulnerability serves as a vector for persistent compromise, potentially leading to broader network infiltration if combined with other attack vectors like phishing or social engineering to trick administrators into viewing the poisoned content.
Mitigation strategies primarily involve upgrading TinyMCE to patched versions immediately. Users should ensure they are running version 7.9.4 or later in the legacy branch, or version 8.9.3 and above for current releases. For organizations unable to upgrade immediately due to compatibility constraints with existing integrations, implementing a Content Security Policy (CSP) can provide an additional layer of defense by restricting script execution sources. Additionally, applying strict server-side sanitization that mirrors the expected input format can help mitigate risks until the software update is applied. It is also recommended to review ATT&CK technique T1059 Command and Scripting Interpreter for understanding how such scripts might be leveraged in subsequent attack phases following initial exploitation.