TinyMCE, a widely used open‑source rich‑text editor, contains a stored Cross‑Site Scripting flaw in its media plugin before specific releases. By embedding malicious scripts through carefully crafted data‑mce‑* attributes, an attacker can cause arbitrary JavaScript to run whenever a page that loads the affected editor renders the content. This permits hijacking of user sessions, theft of credentials, or other client‑side compromise.

The vulnerability affects all releases of TinyMCE older than 5.11.1, 7.9.3, and 8.5.1. Users who deploy the media plugin and allow content to be stored in the editor are susceptible. Any deployment, whether self‑hosted or via Tiny Cloud, is potentially impacted until the editor is upgraded to a fixed version.

The flaw scores a CVSS v3.1 of 8.7, indicating high severity. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog. A stored XSS attack requires the attacker to supply content that is stored and later rendered; typical attack paths include uploading a media item or posting edited content through the editor. Once embedded, the malicious script runs automatically for any user who views the stored data, making the exploit relatively trivial for those who can inject the payload.