A vulnerability marked as problematic has been reported in TinyMCE up to 5.11.0/6.8.6/7.9.2/8.5.0. Affected is an unknown function. Performing a manipulation of the argument data-mce-href/data-mce-src/data-mce-style results in cross site scripting.
This vulnerability was named CVE-2026-47759. The attack may be initiated remotely. There is no available exploit.
It is suggested to upgrade the affected component.
