CVE-2026-116675: 
JavaScript vulnerability analysis and mitigation

CVE-2026-116675 is a stored Cross-Site Scripting (XSS) vulnerability in TinyMCE's media plugin, caused by unsanitized processing of elements crafted via the data-mce-object attribute. It affects TinyMCE versions 7.9.3 and 8.5.1 through 8.9.2 (exclusive), and is fixed in versions 7.9.4 and 8.9.3. The vulnerability was published on October 6, 2026, and assigned a CVSS v4 base score of 8.5 (High) (Github Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in TinyMCE's FilterContent.ts within the media plugin. When processing media content, the plugin used document.createElement() to instantiate elements derived from the data-mce-object attribute in the active (scripting-capable) document context before sanitization, allowing event handler attributes such as onerror or onload on <video>, <audio>, or <img> elements to execute malicious JavaScript. The fix replaces document.createElement() with element creation in a non-scripting document context (via DOMParser) to prevent script execution during processing (Github Advisory, Fix Commit).

Successful exploitation allows an authenticated attacker with access to the TinyMCE editor (media plugin enabled) to store malicious scripts that execute in the browsers of other users who view the affected content. This can result in session token theft, unauthorized actions performed on behalf of victims, and modification of page content — impacting both confidentiality and integrity of the vulnerable system (Github Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (authenticated access to the editor) and passive user interaction from a victim viewing the stored content (Github Advisory, Feedly).

1. Gain editor access: Obtain an account with permission to use the TinyMCE editor on a target application that has the media plugin enabled and runs a vulnerable version (7.9.3 or 8.5.1–8.9.2).
2. Craft malicious media content: Compose a media element payload that abuses the data-mce-object attribute with an event handler, for example: <video data-mce-object="video" onerror="malicious_payload()"> or an <img> with an onerror handler.
3. Store the payload: Submit the crafted content through the TinyMCE editor interface so it is persisted in the application's backend (e.g., a blog post, comment, or page).
4. Trigger execution: When another user (e.g., an administrator or site visitor) views the page containing the stored content, the injected event handler executes in their browser context before sanitization occurs.
5. Achieve objective: Use the executed script to steal session cookies, exfiltrate sensitive data, perform actions on behalf of the victim, or redirect the user to a malicious site (Github Advisory, Fix Commit).

• Network: Unexpected outbound HTTP requests from victim browsers to attacker-controlled domains following page loads containing TinyMCE-rendered media content; unusual POST requests exfiltrating cookies or session tokens.
• Logs: Application logs showing submission of media content containing onerror, onload, or similar event handler attributes within data-mce-object-related elements by low-privileged users.
• File System / Database: Stored content in the CMS or application database containing <video>, <audio>, or <img> tags with inline JavaScript event handlers (e.g., onerror=, onload=) alongside data-mce-object attributes.
• Browser: Unexpected JavaScript execution or network requests triggered when loading pages with TinyMCE-rendered media embeds, visible in browser developer tools network or console tabs.

Upgrade TinyMCE to version 8.9.3 (for the 8.x branch) or 7.9.4 (for the 7.x branch), which fix the vulnerability by sanitizing data-mce-object-derived content before DOM insertion. No official workaround is available from the vendor; however, as an interim measure, disabling or restricting access to the media plugin and implementing strict Content Security Policy (CSP) headers can reduce exploitation risk. Organizations should prioritize patching given the stored XSS nature of the vulnerability (Github Advisory, TinyMCE 8.9.3 Release).

The vulnerability was discovered and responsibly disclosed by security researchers Fariskhi Vidyan and David Vieira Kurz of HiSolutions AG, who were acknowledged by Tiny in the official advisory. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability database aggregation (Github Advisory).