Dashboard / CVE-2026-116675

CVE-2026-116675

HIGH
MEDIUM Priority: 0.03 BB Relevance: 57/100
Published: 2026-10-27 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: Passive
AT: None
VC: High
VI: High
VA: None

Description

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
tinymce tinymce >= 8.5.1, < 8.9.3
tinymce tinymce >= 7.9.3, < 7.9.4
tinymce tinymce >= 8.5.1, < 8.9.3
tinymce tinymce >= 7.9.3, < 7.9.4

References & Advisories (5)

Bug Bounty Relevance

57 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

8.5 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.35%
Raw Score 0.003490
Percentile 28.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00349
2026-10-28
0.00349

Intelligence Sources

mitre ref →
nvd ref →

External Links