PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-116675 tinymce CVE debrief

A stored Cross-Site Scripting (XSS) vulnerability exists in the media plugin of TinyMCE. Attackers can inject malicious scripts via elements crafted through the `data-mce-object` attribute, which are created and executed before sanitization. This impacts users of TinyMCE with the media plugin enabled. The vulnerability has been patched in TinyMCE 8.9.3 and TinyMCE 7.9.4 by ensuring that content created through the `data-mce-object` attribute is properly sanitized first. No official workaround is available, but upgrading to TinyMCE 8.9.3 or higher, or TinyMCE 7.9.4 or higher, mitigates the issue.

Vendor
tinymce
Product
tinymce/tinymce
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-27
Original CVE updated
2026-10-27
Advisory published
2026-10-27
Advisory updated
2026-10-27

Who should care

Defenders responsible for TinyMCE deployments, particularly those using the media plugin, should assess exposure and prioritize upgrading to patched versions to prevent exploitation of this XSS vulnerability.

Why it matters

A stored XSS vulnerability in the media plugin of TinyMCE requires defenders to upgrade to patched versions to prevent exploitation.

  • Defenders must upgrade to patched versions to prevent exploitation
  • XSS vulnerability allows attackers to inject malicious scripts
  • Users of TinyMCE with the media plugin enabled are impacted

Technical summary

The vulnerability is a stored Cross-Site Scripting (XSS) in the media plugin of TinyMCE. Attackers can inject malicious scripts via elements crafted through the `data-mce-object` attribute, which are created and executed before sanitization. This impacts users of TinyMCE with the media plugin enabled. The patches are available in TinyMCE 8.9.3 and TinyMCE 7.9.4. Defenders should prioritize upgrading to patched versions of TinyMCE, specifically 8.9.3 or higher, or 7.9.4 or higher, to prevent exploitation of this XSS vulnerability in the media plugin. The CVE record and source item provide details on the vulnerability, its impact, patches, and acknowledgments.

Defensive priority

Defenders should prioritize upgrading to patched versions of TinyMCE, specifically 8.9.3 or higher, or 7.9.4 or higher, to prevent exploitation of this XSS vulnerability in the media plugin.

Recommended defensive actions

  • Upgrade to TinyMCE 8.9.3 or higher
  • Upgrade to TinyMCE 7.9.4 or higher
  • Review and update affected packages and versions
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, patches, and acknowledgments. The vulnerability is a stored XSS in the media plugin of TinyMCE, which allows attackers to inject malicious scripts. The patches are available in TinyMCE 8.9.3 and TinyMCE 7.9.4.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-116675 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-116675

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-116675 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-116675

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serializat

    Unverified legacy reference

    URL: https://storage.googleapis.com/osv-vulnerabilities/NuGet/GHSA-mf2p-h6hf-fcwm.json

    osv_dev

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tinymce/tinymce/security/advisories/GHSA-mf2p-h6hf-fcwm

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tinymce/tinymce/commit/bd1ab5ef024c648c3f9c0b409e54a6c227c7d8a2

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tinymce/tinymce

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tinymce/tinymce/releases/tag/8.9.3

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://www.tiny.cloud/docs/tinymce/7/7.9.4-release-notes/

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://www.tiny.cloud/docs/tinymce/latest/8.9.3-release-notes/

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.