TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
High · fetched 2026-10-27
### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled. ### Patches This vulnerability has been patched in TinyMCE 8.9.3 and TinyMCE 7.9.4 by ensuring that, when using the media plugin, any content created through the data-mce-object attribute is properly sanitized first. ### Workarounds No official workaround available.
Remediation
Upgrade tinymce to 8.9.3 or later. Upgrade TinyMCE to 8.9.3 or later. Upgrade tinymce/tinymce to 8.9.3 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-27T18:20:12-04:00 · https://github.com/advisories/GHSA-mf2p-h6hf-fcwm