Security readout for executives and security teams
Plain-English summary
TinyMCE’s content sanitizer can be bypassed using nested SVG structures, allowing JavaScript execution in a victim’s browser. This matters for applications where users can create or edit rich text that other users or administrators later view. The documented fix is TinyMCE 7.1.0.
Executive priority
Treat this as high priority for customer portals, admin consoles, CMS features, and support tools using TinyMCE. Business risk is strongest where attacker-controlled content can reach privileged users, potentially exposing sessions, sensitive data, or trusted actions in the browser.
Technical view
CVE-2026-47760 is a CWE-79 XSS issue in TinyMCE caused by improper SVG namespace scope handling during sanitization. The CVSS 3.1 score is 8.7, with network attack vector, low complexity, low privileges, required user interaction, changed scope, and high confidentiality and integrity impact.
Likely exposure
Exposure is likely in applications embedding TinyMCE before 7.1.0, especially where lower-privileged users can submit rich text. The bundle conflicts on affected range: description says 6.8.0 to before 7.1.0, while affected metadata says 6.0.0 to before 7.1.0.
Exploitation context
The source bundle does not indicate known active exploitation, and KEV is false. Exploitation requires a crafted rich-text payload and user interaction, such as someone viewing affected content in a vulnerable workflow. Sources support XSS impact but do not provide evidence of public exploitation.
Researcher notes
The key uncertainty is affected-version precision because the bundle contains two ranges. Validate against the GitHub advisory and deployed artifacts. Do not assume exploit availability from the CVE alone; the provided evidence supports vulnerability and fix, not active exploitation.
Mitigation direction
- Upgrade TinyMCE to 7.1.0 or later.
- Inventory applications that embed TinyMCE and confirm the actual deployed version.
- Review the GitHub advisory for updated vendor guidance or backports.
- Prioritize workflows where untrusted users submit rich text viewed by staff.
- Re-test sanitizer behavior after upgrading affected application paths.
Validation and detection
- Check dependency manifests and deployed static assets for TinyMCE below 7.1.0.
- Identify rich-text workflows accepting content from lower-privileged users.
- Confirm affected pages load the upgraded TinyMCE version.
- Verify stored rich content is sanitized safely after remediation.
- Track the version-range discrepancy when scoping older 6.x deployments.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-47760 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N2.35.8GitHub_MVulnerability scoring details
Base CVSS 3.1 score
8.7HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/tinymce/tinymce/security/advisories/GHSA-mh5m-5hw4-5c69CVE reference, GitHub_M · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.