TinyMCE media plugin stored XSS rated 8.5, patched in 7.9.4 and 8.9.3

TinyMCE 7.9.3 and 8.5.1–8.9.2 are affected by CVE-2026-116675 (CVSS 8.5), a stored XSS in the media plugin that instantiates DOM elements before sanitization, allowing JavaScript execution via data-mce-p-onerror attributes. The flaw is fixed in 7.9.4 and 8.9.3, and a public PoC exists.

• Affects TinyMCE 7.9.3 and 8.5.1–8.9.2, CVSS score 8.5
• Exploit relies on data-mce-object and data-mce-p-onerror attributes
• Fixed in 7.9.4 and 8.9.3; public PoC available
• Workaround: disable the media plugin or enforce a strict CSP