TinyMCE is an open source rich text editor.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 28, 2026 · NIST NVD

   Detected

   TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

2. Oct 14, 2026 · NIST NVD

   Updated

   TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

Affected

• cpe tiny/tinymceversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-47762

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-47762

  30-day exploitation probability 0.3%

  first.org
• NIST NVDVulnerability recordCVE-2026-47762

  TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the pr

  nvd.nist.gov

References

• Vendor Advisory · github.com
• Release Notes · tiny.cloud
• Release Notes · tiny.cloud