CVE-2026-47760
Cross-Site Scripting in TinyMCE Editor
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tinymce | tinymce | From 6.8.0 (inc) to 7.1.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Scripting (XSS) issue found in TinyMCE versions 6.8.0 through 7.0.x. It occurs because the sanitizer improperly handles the SVG namespace scope, allowing an attacker to craft a payload with nested elements that bypass attribute sanitization. This enables the execution of arbitrary JavaScript code.
How can this vulnerability impact me? :
The vulnerability can have a significant impact by allowing attackers to execute arbitrary JavaScript in the context of the affected application. This can lead to unauthorized access to sensitive information, compromise of data integrity, and potentially further attacks on users or systems interacting with the vulnerable TinyMCE editor.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no official detection method or specific commands provided to detect this vulnerability on your network or system.
Since the vulnerability involves a crafted payload exploiting improper SVG namespace scope handling in TinyMCE versions 6.8.0 through 7.0.x, detection would typically require inspecting web application inputs or logs for suspicious nested SVG elements or JavaScript payloads.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade TinyMCE to version 7.1.0 or later, where the vulnerability has been fixed.
No official workaround is available, so applying the patch by updating the software is the recommended immediate action.