For media plugin users, TinyMCE creates elements via data-mce-object serialization before sanitization, allowing malicious script payloads to be processed and executed during handling of those elements. The flaw permits stored cross‑site scripting, meaning attackers can inject JavaScript that will run in the browsers of any users who view the compromised content. This weakness is captured by CWE‑79, which describes client‑side script injection vulnerabilities.

TinyMCE, the open‑source rich text editor, is affected when the media plugin is enabled on any version from 7.9.3 up to, but not including, 7.9.4, and from 8.5.1 up to, but not including, 8.9.3. Versions prior to 7.9.3 and 8.5.1, as well as the fixed releases 7.9.4 and 8.9.3, are not impacted.

The CVSS score of 8.5 categorizes this flaw as a high‑severity vulnerability. The EPSS score is unavailable, so the current exploitation probability is indeterminate, but the lack of listing in CISA KEV suggests no known widespread exploitation yet. The attack vector is most likely through user‑generated content: an attacker who can insert content via the media plugin can embed malicious scripts that are stored and later served to other users. If the media plugin is disabled, or the editor is configured to strip data‑mce‑object content before storage, the vulnerability is mitigated.