TinyMCE, an open‑source rich‑text editor, contains a stored cross‑site scripting flaw that allows forged mce:protected comments to bypass the editor’s sanitization and inject scripts that execute when the content is restored or displayed (CWE‑79).

The vulnerability affects all tinymce:tinymce installations with versions earlier than 5.11.1, 7.9.3, or 8.5.1 that enable the protect option for comments.

The CVSS score of 8.7 classifies the flaw as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack vector is a stored XSS that requires an attacker to submit or modify content that will later be rendered for users with the protect option enabled. Once the forged comment is inserted, the malicious script will run automatically for any user who views the content, enabling client‑side code execution.