XSS Vulnerability in TinyMCE Rich Text Editor by Tiny
CVE-2026-47760

8.7HIGH

Key Information:

Vendor

Tinymce

Status
Tinymce
Vendor
CVE Published:
28 May 2026

What is CVE-2026-47760?

TinyMCE, a widely used open-source rich text editor, is vulnerable to a Cross-Site Scripting (XSS) attack due to improper SVG namespace scope handling in its sanitizer. This vulnerability affects versions from 6.8.0 and prior to 7.1.0. A malicious actor can exploit this flaw by crafting a specific payload utilizing nested elements that bypasses necessary attribute sanitization, allowing arbitrary JavaScript execution. The vulnerability was addressed in version 7.1.0, underscoring the importance of keeping software updated to safeguard against potential security threats.

Affected Version(s)

tinymce >= 6.0.0, < 7.1.0

References

https://github.com/tinymce/tinymce/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.