CVE-2026-47762: TinyMCE Stored XSS via Protected Comments – CVSS 8.7 HIGH

Technical summary

The vulnerability is a stored XSS flaw (CWE-79) in TinyMCE's content protection mechanism. Attackers with authenticated access can craft malicious mce:protected comments that evade the editor's content sanitization filters. Because the malicious payload is stored server-side as part of the protected content metadata, it persists across sessions. When the editor restores or renders protected content, the script executes with the privileges of the viewing user, potentially in a cross-site context depending on deployment. The root cause appears to be insufficient validation or encoding of data within the mce:protected comment wrapper, allowing comment syntax to contain unfiltered script payloads that are later unwrapped and executed.

Business impact

Organizations using TinyMCE-based document editors, content management systems, or form builders face session hijacking, credential theft, and data exfiltration risks if attackers gain authenticated access. Because the payload is stored and triggered on view, the attack surface extends to all users who subsequently access the compromised content—not just the initial editor. In multi-tenant environments or shared document platforms, a single compromised record can affect many downstream users. Remediation requires patching and potentially invalidating or re-validating existing protected content that may have been maliciously modified.

Affected systems

All deployments of TinyMCE versions prior to 5.11.1 (legacy branch), 7.9.3 (mid-term), and 8.5.1 (current) are affected. The vulnerability only manifests when the protect option is enabled in the editor configuration. Organizations should identify which applications and instances embed TinyMCE and whether they use content protection features. Third-party integrations—including WordPress plugins, CMS platforms, and custom web applications—that bundle TinyMCE are potentially affected and require verification of their upstream dependency versions.

Exploitability

Exploitation requires authenticated access to the TinyMCE editor interface (PR:L per CVSS vector), meaning an attacker must already have user privileges or a compromised account. However, the user interaction requirement (UI:R) is limited to the attacker triggering content restoration, which is a low bar in many workflows. The attack vector is network-based (AV:N) with no complex prerequisites (AC:L), making it relatively straightforward to execute once inside. The stored nature of the payload means the attacker does not need to be present when the script executes—any user viewing the affected content becomes a victim. CVSS 8.7 (HIGH) reflects the combination of moderate access requirements, high confidentiality and integrity impact, and cross-site scope.

Remediation

Upgrade to TinyMCE 5.11.1, 7.9.3, or 8.5.1 depending on your current version branch. Administrators should assess which protected content may have been modified by unauthorized parties and consider re-validating or clearing such content if compromise is suspected. If immediate patching is not feasible, disable the protect option in TinyMCE configuration to prevent new payloads from being stored, though this may impact content workflow. Implement strong access controls and session management to reduce the likelihood of authenticated compromise. Monitor for unusual editor activity or content modifications.

Patch guidance

Apply the vendor patches as soon as feasible: upgrade to 5.11.1 for the 5.x branch, 7.9.3 for the 7.x branch, or 8.5.1 for the 8.x branch. Verify the patch version in your installed instance and in any bundled or third-party integrations. If TinyMCE is embedded in a plugin or framework, check the upstream maintainer's advisory for compatible versions and upgrade guidance. After patching, clear browser caches and invalidate user sessions to prevent stale JavaScript from executing. Test content restoration workflows in a staging environment to confirm the patch does not affect legitimate protected content handling.

Detection guidance

Search logs and audit trails for authenticated users accessing the editor to create or modify protected content, particularly outside normal business hours or from unusual locations. Look for mce:protected comment patterns containing suspicious JavaScript keywords (script, eval, fetch, XMLHttpRequest) in stored content or revision history. Monitor for stored procedures or database queries that insert or update protected content metadata. Implement content security policy (CSP) headers to limit the blast radius if injected scripts do execute. Use Web Application Firewalls (WAF) to flag requests containing mce:protected payloads with inline JavaScript, though this should complement, not replace, patching.

Why prioritize this

Despite the HIGH CVSS score, this vulnerability's practical impact depends on whether the protect feature is active and whether the attacker has authenticated access. However, stored XSS in a rich text editor affects entire document audiences, multiplying the impact per compromise. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting limited in-the-wild exploitation at this time, but this should not lower priority for organizations heavily dependent on TinyMCE-based collaboration or content platforms. Prioritize patching if your users edit shared or sensitive content; deprioritize slightly if the protect feature is unused, but still patch to close a future attack vector.

Risk score, explained

The CVSS 8.7 (HIGH) score reflects: (1) network-based, unauthenticated-seeming attack (AV:N, AC:L), (2) moderate authentication barrier (PR:L) that is realistic in many organizations, (3) user interaction requirement (UI:R) that is low friction, (4) high impact to confidentiality and integrity (C:H, I:H) via script injection, and (5) cross-site scope (S:C) implying potential to affect other users or systems. Availability is not impacted (A:N). The score is justified for environments where TinyMCE is deployed in collaborative or customer-facing contexts; organizations with highly restricted editor access may perceive lower practical risk.

Frequently asked questions