CVE-2026-116675 with a CVSS score of 8.5 is a stored cross-site scripting vulnerability in TinyMCE, affecting tinymce (npm), TinyMCE (NuGet), and tinymce/tinymce (Composer) packages. The flaw affects end users of TinyMCE. It occurs when content created through the data-mce-object attribute is crafted by an attacker and created and executed before sanitization. A remote attacker with low privileges can exploit the vulnerability by causing a user to interact with malicious content, allowing script execution in the context of the affected web application. This can lead to session hijacking, unauthorized actions, disclosure of sensitive data, defacement, or further compromise of users and systems that rely on the editor.
We recommend you to update TinyMCE (nuget), tinymce (npm) and tinymce/tinymce (composer) to version 8.9.3 or 7.9.4 or later.[/subscribe_to_unlock_form]
CVE-2026-116675 with a CVSS score of 8.5 is a stored cross-site scripting vulnerability in TinyMCE, affecting tinymce (npm), TinyMCE (NuGet), and tinymce/tinymce (Composer) packages. The flaw affects end users of TinyMCE. It occurs when content created through the data-mce-object attribute is crafted by an attacker and created and executed before sanitization. A remote attacker with low privileges can exploit the vulnerability by causing a user to interact with malicious content, allowing script execution in the context of the affected web application. This can lead to session hijacking, unauthorized actions, disclosure of sensitive data, defacement, or further compromise of users and systems that rely on the editor.
We recommend you to update TinyMCE (nuget), tinymce (npm) and tinymce/tinymce (composer) to version 8.9.3 or 7.9.4 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]