PKSA-bdqg-yq3b-xsg6: TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
Published Oct 27, 2026
·Updated
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin data-mce-object serialization
Affected Software
2 affected componentsFixes available
composer/tinymce/tinymce=7.9.3
composer/tinymce/tinymce>=8.5.1, <8.9.3
8.9.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/tinymce/tinymceto a version that resolves this vulnerability.Fixed in 8.9.3
Event History
Oct 27, 2026
Advisory Published
via Packagist·09:07 PM
Data Sourced
via Packagist·09:07 PM
DescriptionSeverityAffected Software