Cross-site scripting in TinyMCE - CVE-2026-47761
Published: May 20, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU131920
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-47761
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in the victim's browser.
The vulnerability exists due to improper neutralization of input during web page generation in the media plugin when rendering content containing crafted data-mce-* attributes. A remote user can inject crafted data-mce-object and related data-mce-p-* attributes to execute arbitrary script in the victim's browser.
User interaction is required when the malicious content is rendered, and only instances with the media plugin enabled are vulnerable.
Affected software
TinyMCE
Jira Software Data Center
Jira Service Management Data Center
Jira Software Data Center
Jira Service Management Data Center
How to mitigate CVE-2026-47761
Install security update from vendor's website.
TinyMCE - addressed in versions 5.11.1, 7.9.3, 8.5.1
Jira Software Data Center - update to 10.3.25
Jira Service Management Data Center - update to 10.3.25
Jira Software Data Center - update to 10.3.25
Jira Service Management Data Center - update to 10.3.25