TinyMCE: Stored cross-site scripting in media plugin

Summary

TinyMCE, an open source rich text editor, has a stored Cross-Site Scripting vulnerability in its media plugin. Crafted data-mce-object elements are processed before sanitization and can execute malicious scripts. An attacker who can enter rich text that a victim later views, for example in a CMS, portal or ticket system, could run scripts in the victim's browser and potentially compromise sessions or accounts, especially in admin or back-office editors. The issue only applies where the media plugin is enabled.

Affected

• TinyMCE 8.5.1 up to but not including 8.9.3
• TinyMCE 7.9.3 up to but not including 7.9.4
• Whether older releases are affected is unknown.

Fixed in

• TinyMCE 8.9.3
• TinyMCE 7.9.4

Workaround

• No vendor-documented workaround. Upgrading is the fix.
• A third-party write-up suggests disabling the media plugin if patching is not immediately possible. This is not an official vendor recommendation.
• Server-side sanitisation of internal TinyMCE attributes before storing user content is defence-in-depth only and must be validated with developers.

Exploitation

• CISA SSVC: exploitation none, not automatable, total technical impact.
• No evidence of exploitation in the wild found.
• No public proof-of-concept found. A third-party write-up describes the root cause.

Our recommendation

• Inventory all TinyMCE instances, including npm, NuGet, Packagist and bundled copies in CMS plugins.
• Upgrade to 8.9.3 or 7.9.4 and verify the running version in the browser.
• Prioritise internet-facing and admin-facing editors.
• If you cannot patch promptly, disable the media plugin where possible.
• Check the npm registry for 7.9.4 availability before relying on it for self-hosted deployments; an unverified report says it is unavailable.
• Plan for regular TinyMCE updates, as several similar advisories were published in 2026.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-mf2p-h6hf-fcwm github.com
• Fix commit bd1ab5ef github.com
• TinyMCE 8.9.3 release notes www.tiny.cloud
• TinyMCE 7.9.4 release notes www.tiny.cloud
• TinyMCE 8.9.3 GitHub release github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:57.