CVE-2026-116675
Severity not reportedData quality: awaiting analysis.
NVD has not completed analysis, so CVSS and affected-product data may be missing or change.
TinyMCE is an open source rich text editor.
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.
CVSS
—
Awaiting analysis by NVD
Timeline (UTC)
Published: 2026-10-27 17:16
Modified: 2026-10-28 17:18
NVD status: Awaiting Analysis
Last synced 1 day ago
Verified against the source API 2026-10-28 17:38 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/tinymce/tinymce/commit/bd1ab5ef024c648c3f9c0b409e54a6c227c7d8a2 security-advisories@github.com
- https://github.com/tinymce/tinymce/releases/tag/8.9.3 security-advisories@github.com
- https://github.com/tinymce/tinymce/security/advisories/GHSA-mf2p-h6hf-fcwm security-advisories@github.com
- https://www.tiny.cloud/docs/tinymce/7/7.9.4-release-notes/#overview security-advisories@github.com
- https://www.tiny.cloud/docs/tinymce/latest/8.9.3-release-notes/#overview security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-28 17:38 UTC · record ↗