CVE-2026-47759: TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
Impact Stored XSS vulnerability via unsanitized data-mce- attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation.
Patches Patched by stripping unsafe data-mce- attributes during parsing. Users should upgrade to the latest patched versions (5 LTS, 7.x, 8.x).
Workarounds No official workaround available.
Fix To avoid this vulnerability:
Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial long-term support contract).
Acknowledgements Tiny thanks Tadi Kadango (website) and Ivan Babenko for their help identifying this vulnerability.
Other sources
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
— Packagist
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce- attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/tinymce/tinymceto a version that resolves this vulnerability.Fixed in 8.5.1 - Upgrade
Upgrade
composer/tinymce/tinymceto a version that resolves this vulnerability.Fixed in 7.9.3 - Upgrade
Upgrade
nuget/TinyMCEto a version that resolves this vulnerability.Fixed in 8.5.1 - Upgrade
Upgrade
nuget/TinyMCEto a version that resolves this vulnerability.Fixed in 7.9.3 - Upgrade
Upgrade
nuget/TinyMCEto a version that resolves this vulnerability.Fixed in 5.11.1 - Upgrade
Upgrade
npm/tinymceto a version that resolves this vulnerability.Fixed in 8.5.1 - Upgrade
Upgrade
npm/tinymceto a version that resolves this vulnerability.Fixed in 7.9.3 - Upgrade
Upgrade
TinyMCEto a version that resolves this vulnerability.Fixed in 5.11.1 - Upgrade
Upgrade
TinyMCEto a version that resolves this vulnerability.Fixed in 7.9.3 - Upgrade
Upgrade
TinyMCEto a version that resolves this vulnerability.Fixed in 8.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47759?
The severity of CVE-2026-47759 is rated high, with a score of 8.7.
What type of vulnerability is CVE-2026-47759?
CVE-2026-47759 is a Cross-Site Scripting (XSS) vulnerability.
How does CVE-2026-47759 impact TinyMCE?
CVE-2026-47759 allows attackers to inject malicious values through unsanitized data-mce-* attributes, potentially compromising user data.
How do I fix CVE-2026-47759?
To mitigate CVE-2026-47759, upgrade TinyMCE to version 5.11.1, 7.9.3, or 8.5.1 or later.
What versions of TinyMCE are affected by CVE-2026-47759?
CVE-2026-47759 affects TinyMCE versions prior to 5.11.1, 7.9.3, and 8.5.1.