Zero Radar
← feed
HighVulnerabilityCVE-2026-116675updated 27 Oct 2026, 21:08 UTC

TinyMCE editor: stored script injection via media plugin

Someone could save hidden code inside text written in the TinyMCE editor. When the media plugin processes it, that code can run in other users' browsers.

Fix availableOfficial, 2 sources
SeverityHighCVSS 8.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesTinyMCE 8.9.3 (8.x line) and TinyMCE 7.9.4 (7.x line) · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker submits contentCrafted data-mce-object element in input
  2. 2Media plugin processes itElement is created before sanitization
  3. 3Script executesRuns during processing in the editor
  4. 4Victim views the pageStored content triggers the script for them
  5. ResultAttacker runs scripts in victims' browsers

What happened

Stored cross-site scripting in TinyMCE's media plugin: elements crafted via the data-mce-object attribute are created and can execute scripts before sanitization runs.

Why it is dangerous: An attacker who can submit content to a site using this editor can run scripts in the browsers of users who view it, potentially stealing sessions or acting as those users.

Are you affected?

You are affected if you use TinyMCE 8.5.1 up to (not including) 8.9.3, or TinyMCE 7.9.3 (fixed in 7.9.4), with the media plugin enabled.

Package / productAffected versionsFixed in
tinymce · npm>= 8.5.1, < 8.9.38.9.3
TinyMCE · nuget>= 8.5.1, < 8.9.38.9.3
tinymce/tinymce · composer>= 8.5.1, < 8.9.38.9.3
tinymce · npm= 7.9.37.9.4
TinyMCE · nuget= 7.9.37.9.4
tinymce/tinymce · composer= 7.9.37.9.4

What to do

  1. Update TinyMCE to 8.9.3 or later if you use the 8.x line
  2. Update TinyMCE to 7.9.4 or later if you use the 7.x line
  3. If you cannot update right away, check whether the media plugin is enabled and consider disabling it; no official workaround is provided

Timeline

  1. 27 Oct 2026, 17:16 UTC
    Publicly disclosed
  2. 27 Oct 2026, 17:16 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 17:20 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 21:08 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 21:08 UTC
    Fixed version published: tinymce 8.9.3, TinyMCE 8.9.3, tinymce/tinymce 8.9.3 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116675 · GHSA-mf2p-h6hf-fcwm
CVSS
8.5 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 17:16 UTC
On Zero Radar
27 Oct 2026, 17:20 UTC (4 min after disclosure)
Last change
27 Oct 2026, 21:08 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

TinyMCE editor: stored script injection via media plugin · Zero Radar