CVE-2026-47759: TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

Synopsis

A stored cross-site scripting (XSS) vulnerability affects the TinyMCE rich text editor across versions prior to 5.11.1, 7.9.3, and 8.5.1. The flaw is reachable over the network by an attacker with a low-privilege account, but requires a victim to view or interact with content containing the injected payload. Successful exploitation lets an attacker read session tokens and sensitive page data, or modify page content in the context of another user's browser session. Patched-image rebuilds at versions 5.11.1, 7.9.3, and 8.5.1 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the application over the network to submit content containing malicious data-mce-* attribute values.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker only needs enough access to submit rich-text content through the editor.

• Victim interactionRequired

  A victim must view or load a page rendering the attacker-injected content for the stored XSS payload to execute in their browser.

• Attack complexityDetail

  Exploit complexity is low; no race conditions or special environmental factors are required, and the injection reliably bypasses TinyMCE's attribute sanitization during serialization.

Blast Radius

• Reads session tokens and authentication cookies from the victim's browser, enabling account takeover.
• Reads sensitive page content visible to the victim, including any personal or application data rendered in the same origin.
• Modifies page content or injects UI elements in the victim's browser session, enabling phishing or credential harvesting within the application.