Description
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. This vulnerability is fixed in 5.11.1, 7.9.3, and 8.5.1.
Remediation
References
Related Vulnerabilities
WordPress Plugin PAYPAL CURRENCY CONVERTER BASIC FOR WOOCOMMERCE Arbitrary File Disclosure (1.3)
WordPress Plugin Qwizcards-online quizzes and flashcards Cross-Site Scripting (3.61)
MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2026-34093)
WordPress Plugin WordPress PDF Light Viewer Command Injection (1.4.11)
Liferay Portal Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2025-43810)