High severity · published Oct 27, 2026
CVE-2026-116675
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
New
8.5
CVSS
0.3%
EPSS
No
On KEV
Description
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
tinymce · tinymce
>= 8.5.1, < 8.9.3; >= 7.9.3, < 7.9.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116675
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116675
github.com
https://github.com/tinymce/tinymce/commit/bd1ab5ef024c648c3f9c0b409e54a6c227c7d8a2
github.com
https://github.com/tinymce/tinymce/releases/tag/8.9.3
github.com
https://github.com/tinymce/tinymce/security/advisories/GHSA-mf2p-h6hf-fcwm
www.tiny.cloud
https://www.tiny.cloud/docs/tinymce/7/7.9.4-release-notes/#overview
www.tiny.cloud
https://www.tiny.cloud/docs/tinymce/latest/8.9.3-release-notes/#overview
More from tinymce
6.1
CVE-2024-38357
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
6.1
CVE-2024-38356
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
6.1
CVE-2024-29881
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
6.1
CVE-2024-29203
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
6.1
CVE-2023-48219
Special characters in unescaped text nodes can trigger mXSS in TinyMCE