{"id":"CVE-2026-47762","aliases":["CLSA-2026-1781052744","CLSA-2026-1783904630","CLSA-2026-1784077492","EUVD-2026-32923","GHSA-v98h-vmpc-fpqv","UBUNTU-CVE-2026-47762"],"status":"published","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments","description":"TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.","severity":{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00281,"percentile":0.20768,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-05-28T15:21:36Z","modified":"2026-10-28T02:30:20Z","fixes":[{"ecosystem":"npm","package":"tinymce","fixed_in":["7.9.3","8.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"TinyMCE","fixed_in":["7.9.3","8.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"tinymce/tinymce","fixed_in":["7.9.3","8.5.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.9.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.1"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"TinyMCE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.9.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"TinyMCE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"tinymce/tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.9.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"tinymce/tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.10.9"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"TinyMCE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.10.9"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"tinymce/tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.10.9"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.6-tuxcare.0"},{"fixed":"6.8.6-tuxcare.4"}]}],"versions":["6.8.6","6.8.6-tuxcare.1","6.8.6-tuxcare.2","6.8.6-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.11-tuxcare.0"},{"fixed":"4.9.11-tuxcare.2"}]}],"versions":["4.9.11","4.9.11-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.10.9-tuxcare.0"},{"fixed":"5.10.9-tuxcare.2"}]}],"versions":["5.10.9","5.10.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"tinymce","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"5.10.9"}]}]},{"source":"osv","ecosystem":"npm","package":"tinymce","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"7.9.3"}]}]},{"source":"osv","ecosystem":"npm","package":"tinymce","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.5.1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"TinyMCE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.10.9"}]}],"versions":["3.4.3.2","3.4.4","3.4.5","3.4.7","3.5.0","3.5.0.1","3.5.1","3.5.1.1","3.5.2","3.5.3","3.5.4","3.5.4.1","3.5.5","3.5.6","3.5.7","3.5.8","4.0.0","4.0.1","4.0.10","4.0.11","4.0.13","4.0.14","4.0.15","4.0.16","4.0.17","4.0.18","4.0.19","4.0.2","4.0.20","4.0.21","4.0.22","4.0.23","4.0.24","4.0.25","4.0.26","4.0.27","4.0.28","4.0.4","4.0.5","4.0.6","4.0.8","4.0.9","4.1.0","4.1.1","4.1.10","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.3.0","4.3.1","4.3.10","4.3.11","4.3.12","4.3.13","4.3.2","4.3.3","4.3.4","4.3.6","4.3.7","4.3.8","4.3.9","4.4.0","4.4.1","4.4.2","4.4.3","4.5.0","4.5.1","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.7","4.5.8","4.6.0","4.6.1","4.6.2","4.6.3","4.6.4","4.6.5","4.6.6","4.6.7","4.7.0","4.7.10","4.7.11","4.7.12","4.7.13","4.7.3","4.7.4","4.7.5","4.7.6","4.7.7","4.7.8","4.7.9","4.8.0","4.8.1","4.8.2","4.8.3","4.8.4","4.8.5","4.9.0","4.9.1","4.9.10","4.9.11","4.9.2","4.9.3","4.9.4","4.9.5","4.9.6","4.9.7","4.9.8","4.9.9","5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.15","5.0.16","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.1.0","5.1.1","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.10.0","5.10.1","5.10.2","5.10.3","5.10.4","5.10.5","5.10.6","5.10.7","5.10.8","5.10.9","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.3.2","5.4.0","5.4.1","5.4.2","5.5.0","5.5.1","5.6.0","5.6.1","5.6.2","5.7.0","5.7.1","5.8.0","5.8.1","5.8.2","5.9.0","5.9.1","5.9.2"]},{"source":"osv","ecosystem":"NuGet","package":"TinyMCE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.9.3"}]}],"versions":["6.0.0","6.0.1","6.0.2","6.0.3","6.1.0","6.1.1","6.1.2","6.2.0","6.3.0","6.3.1","6.3.2","6.4.0","6.4.1","6.4.2","6.5.0","6.5.1","6.6.2","6.7.0","6.7.1","6.7.2","6.7.3","6.8.0","6.8.1","6.8.2","6.8.3","6.8.4","6.8.5","6.8.6","7.0.0","7.0.1","7.1.0","7.1.1","7.1.2","7.2.0","7.2.1","7.3.0","7.4.0","7.4.1","7.5.0","7.5.1","7.6.0","7.6.1","7.7.0","7.7.1","7.7.2","7.8.0","7.9.0","7.9.1","7.9.2"]},{"source":"osv","ecosystem":"NuGet","package":"TinyMCE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.1"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.1.0","8.1.1","8.1.2","8.2.0","8.2.1","8.2.2","8.3.0","8.3.1","8.3.2","8.4.0","8.5.0"]},{"source":"osv","ecosystem":"Packagist","package":"tinymce/tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.10.9"}]}],"versions":["4.0.0","4.0.1","4.0.10","4.0.11","4.0.12","4.0.13","4.0.14","4.0.15","4.0.16","4.0.17","4.0.18","4.0.19","4.0.2","4.0.20","4.0.21","4.0.22","4.0.23","4.0.24","4.0.25","4.0.26","4.0.27","4.0.28","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.1","4.1.10","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.3.0","4.3.1","4.3.10","4.3.11","4.3.12","4.3.13","4.3.2","4.3.3","4.3.4","4.3.6","4.3.7","4.3.8","4.3.9","4.4.0","4.4.1","4.4.2","4.4.3","4.5.0","4.5.1","4.5.12","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.7","4.5.8","4.5.9","4.6.0","4.6.1","4.6.2","4.6.3","4.6.4","4.6.5","4.6.6","4.6.7","4.7.0","4.7.1","4.7.10","4.7.11","4.7.12","4.7.13","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6","4.7.7","4.7.8","4.7.9","4.8.0","4.8.1","4.8.2","4.8.3","4.8.4","4.8.5","4.9.0","4.9.1","4.9.10","4.9.11","4.9.2","4.9.3","4.9.4","4.9.5","4.9.6","4.9.7","4.9.8","4.9.9","5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.15","5.0.16","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.1.0","5.1.1","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.10.0","5.10.1","5.10.2","5.10.3","5.10.4","5.10.5","5.10.6","5.10.7","5.10.8","5.10.9","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.3.2","5.4.0","5.4.1","5.4.2","5.5.0","5.5.1","5.6.0","5.6.1","5.6.2","5.7.0","5.7.1","5.8.0","5.8.1","5.8.2","5.9.0","5.9.1","5.9.2"]},{"source":"osv","ecosystem":"Packagist","package":"tinymce/tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.9.3"}]}],"versions":["6.0.0","6.0.1","6.0.2","6.0.3","6.1.0","6.1.1","6.1.2","6.2.0","6.3.0","6.3.1","6.3.2","6.4.0","6.4.1","6.4.2","6.5.0","6.5.1","6.6.0","6.6.1","6.6.2","6.7.0","6.7.1","6.7.2","6.7.3","6.8.0","6.8.1","6.8.2","6.8.3","6.8.4","6.8.5","6.8.6","7.0.0","7.0.1","7.1.0","7.1.1","7.1.2","7.2.0","7.2.1","7.3.0","7.4.0","7.4.1","7.5.0","7.5.1","7.6.0","7.6.1","7.7.0","7.7.1","7.7.2","7.8.0","7.9.0","7.9.1","7.9.2"]},{"source":"osv","ecosystem":"Packagist","package":"tinymce/tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.1"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.1.0","8.1.1","8.1.2","8.2.0","8.2.1","8.2.2","8.3.0","8.3.1","8.3.2","8.4.0","8.5.0"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.8+dfsg0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.8+dfsg0-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tinymce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.8+dfsg0-2"]}],"products":[{"vendor":"tiny","product":"tinymce"},{"vendor":"tinymce","product":"tinymce"}],"references":[{"url":"https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47762","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v98h-vmpc-fpqv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47762.json","tags":["advisory"]},{"url":"https://github.com/tinymce/tinymce","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-47762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47762","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-47762","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments","description":"TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.","status":"published","published":"2026-05-28T15:21:36.882Z","modified":"2026-05-28T19:14:42.376Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-32923","description":"TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.","status":"published","published":"2026-05-28T15:21:36Z","modified":"2026-05-28T19:14:42Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:21:01.680356Z"}],"ghsa":[{"id":"GHSA-v98h-vmpc-fpqv","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments","description":"### Impact\nStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option.\n\n### Patches\nPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version.\n\n### Workarounds\nNo official workaround available.\n\n### Fix\nTo avoid this vulnerability:\n\nUpgrade to TinyMCE 8.5.1 or higher.\nUpgrade to TinyMCE 7.9.3 or higher.\nUpgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial [long-term support](https://www.tiny.cloud/long-term-support/) contract).\n\n### Acknowledgements\nTiny thanks [Ivan Babenko](https://github.com/he1d3n) for their help identifying this vulnerability.","status":"published","published":"2026-06-05T20:29:07Z","modified":"2026-07-15T21:07:04Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:43.958448Z"}],"nvd":[{"id":"CVE-2026-47762","description":"TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.","status":"published","published":"2026-05-28T16:16:28.47Z","modified":"2026-10-14T20:10:00.19Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:21.244426Z"}],"osv":[{"id":"CVE-2026-47762","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments","description":"TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.","status":"published","published":"2026-05-28T15:21:36.882Z","modified":"2026-10-28T02:30:20.44140217Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:06.231145Z"},{"id":"GHSA-v98h-vmpc-fpqv","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments","description":"### Impact\nStored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option.\n\n### Patches\nPatched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version.\n\n### Workarounds\nNo official workaround available.\n\n### Fix\nTo avoid this vulnerability:\n\nUpgrade to TinyMCE 8.5.1 or higher.\nUpgrade to TinyMCE 7.9.3 or higher.\nUpgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial [long-term support](https://www.tiny.cloud/long-term-support/) contract).\n\n### Acknowledgements\nTiny thanks [Ivan Babenko](https://github.com/he1d3n) for their help identifying this vulnerability.","status":"published","published":"2026-06-05T20:29:07Z","modified":"2026-07-15T21:15:18.068923354Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"UBUNTU-CVE-2026-47762","description":"TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.","status":"published","published":"2026-05-28T16:16:00Z","modified":"2026-06-03T11:26:15Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"CLSA-2026-1781052744","title":"TuxCare security update for tinymce (4 CVEs)","description":"TuxCare rebuilt tinymce to address 4 CVEs. Fixed in 6.8.6-tuxcare.4.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-10-15T09:47:50.746529586Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1783904630","title":"TuxCare security update for tinymce (3 CVEs)","description":"TuxCare rebuilt tinymce to address 3 CVEs. Fixed in 4.9.11-tuxcare.2.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-10-15T09:47:36.240917863Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784077492","title":"TuxCare security update for tinymce (3 CVEs)","description":"TuxCare rebuilt tinymce to address 3 CVEs. Fixed in 5.10.9-tuxcare.2.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-15T09:47:28.888373188Z","updated_at":"2026-11-02T15:43:46.151924Z"}]}}