- Packages
- tinymce, TinyMCE, tinymce/tinymce
- Fixed in
- 8.9.3, 7.9.4
- Published
- Tue 27 Oct 2026, 21:07 Lisbon
In plain words
This stored cross-site scripting flaw lets attackers inject malicious scripts into content when TinyMCE's media plugin is enabled. Content created through the data-mce-object attribute can execute before it is sanitised.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| tinymce | >= 8.5.1, < 8.9.3 | 8.9.3 |
| TinyMCE | >= 8.5.1, < 8.9.3 | 8.9.3 |
| tinymce/tinymce | >= 8.5.1, < 8.9.3 | 8.9.3 |
| tinymce | = 7.9.3 | 7.9.4 |
| TinyMCE | = 7.9.3 | 7.9.4 |
| tinymce/tinymce | = 7.9.3 | 7.9.4 |
Am I affected?
In composer.lock, look for tinymce, TinyMCE or tinymce/tinymce. Affected versions are 8.5.1 up to but not including 8.9.3, and exactly 7.9.3. If you use an affected version, check whether the media plugin is enabled in your TinyMCE configuration. The fixes are 8.9.3 and 7.9.4.
What to do
Check which version you have, then update to a fixed release for your branch (8.9.3, 7.9.4):
composer show tinymce | grep versions
composer update tinymceIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
Impact
Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled.
Patches
This vulnerability has been patched in TinyMCE 8.9.3 and TinyMCE 7.9.4 by ensuring that, when using the media plugin, any content created through the data-mce-object attribute is properly sanitized first.
Workarounds
No official workaround available.
Fix
To avoid this vulnerability:
Upgrade to TinyMCE 8.9.3 or higher. Upgrade to TinyMCE 7.9.4 or higher.
Acknowledgements
Tiny thanks Fariskhi Vidyan and David Vieira Kurz (HiSolutions AG) for their help identifying this vulnerability.
Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Reported by farisv, secalert.
The advisory
- GitHub Advisory Database: GHSA-mf2p-h6hf-fcwm, with who is affected and how
- OSV.dev: GHSA-mf2p-h6hf-fcwm
- All advisories for tinymce/tinymce