CVE-2026-47762

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47762
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47762.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47762
Aliases
Downstream
Published
2026-05-28T15:21:36.882Z
Modified
2026-07-15T01:49:21.982116347Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
Details

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47762.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "5.11.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/tinymce/tinymce

Affected ranges

Type
GIT
Repo
https://github.com/tinymce/tinymce
Events
Introduced
4cc623897917472ba418f1378170727d7a94575b
Fixed
9dac5bb3c875b9c5de43a3f6ea33f55437e77325
Introduced
9f7ab4d2acef062e7f2cd85e7498e3016446ff65
Fixed
03573dd3ca7ac79f79b8f6e66f3b4256d3e1de36
Database specific 
{
    "cpe": "cpe:2.3:a:tiny:tinymce:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "7.9.3"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.5.1"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47762.json"