CVE-2026-47761: tinymce before 5.11.1 (exclusive), from 6.0.0 (inclusive), before 7.9.3 (exclusive), from 8.0.0 (inclusive), before…

Affected technology

tinymce · before 5.11.1 (exclusive)
tiny

tinymce · from 6.0.0 (inclusive), before 7.9.3 (exclusive)
tiny

tinymce · from 8.0.0 (inclusive), before 8.5.1 (exclusive)
tiny

tinymce · < 5.11.1, >= 6.0.0, <= 6.8.6, >= 7.0.0, < 7.9.3, >= 8.0.0, < 8.5.1
tinymce

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Vendor/CNA’s CVSS 3.1 assessment (base score 8.7/10) rates confidentiality and integrity impact as high; availability impact as none. NVD’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.