https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T19:30:35.551077+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/ghsa-v98h-vmpc-fpqv GHSA-v98h-vmpc-fpqv — TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments 2026-10-06T19:30:35.552309+00:00

Affected: npm: tinymce, NuGet: TinyMCE, Packagist: tinymce/tinymce

### Impact Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option.

### Patches Patched by validating decoded mce:protected content against configured protect regex rules before restoring. Users should upgrade to the latest patched version.

### Workarounds No official workaround available.

### Fix To avoid this vulnerability:

Upgrade to TinyMCE 8.5.1 or higher. Upgrade to TinyMCE 7.9.3 or higher. Upgrade to TinyMCE 5.11.1 LTS or higher for TinyMCE 5.x (only available as part of commercial [long-term support](https://www.tiny.cloud/long-term-support/) contract).

### Acknowledgements Tiny thanks [Ivan Babenko](https://github.com/he1d3n) for their help identifying this vulnerability.