Medium severity · published May 28, 2026
CVE-2026-47760
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerability is fixed in 7.1.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
tinymce · tinymce
>= 6.0.0, < 7.1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47760
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47760
Vendor Advisory
https://github.com/tinymce/tinymce/security/advisories/GHSA-mh5m-5hw4-5c69
More from tinymce
8.5
CVE-2026-116675
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
6.1
CVE-2024-38357
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
6.1
CVE-2024-38356
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
6.1
CVE-2024-29881
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
6.1
CVE-2024-29203
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes