Notifications
Clear all
Topic starter
20/08/2026 6:00 pm
TL;DR: TinyMCE published four high-severity stored XSS advisories affecting packages across npm, NuGet, and Composer, with CVSS 3.1 scores of 8.7 and vulnerable branches spanning 5.x, 7.x, and 8.x. Corgea’s analysis shows how editor-internal attributes and protected content can survive sanitization and execute in administrator browsers, turning content editing into privilege abuse.
NHIMG editorial — based on content published by Corgea: analysis of four high-severity stored XSS advisories in TinyMCE
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: What breaks when stored XSS exists in a rich-text editor workflow?
A: Stored XSS breaks the trust boundary between content creation and content review.
Q: Why do CMS and SaaS admin consoles make stored XSS more dangerous?
A: These consoles often grant privileged users the ability to modify templates, plugins, themes, or integrations.
Q: How do security teams know whether editor sanitisation is actually working?
A: Test the full save, reload, preview, and publish cycle with hostile attributes, SVG payloads, media embeds, and protected-comment variants.
Practitioner guidance
- Patch to a fixed TinyMCE branch Move affected deployments to TinyMCE 5.11.1, 7.9.3, 7.1.0, or 8.5.1 as applicable to the branch in use, and verify bundled copies inside CMS plugins or SaaS components rather than only direct package references.
- Search persisted content for editor-specific markers Scan stored HTML for data-mce-href, data-mce-src, data-mce-style, data-mce-object, mce:protected, and suspicious nested SVG patterns, then triage matches as content that may already carry a payload.
- Review editor-role access and abandonment risk Check contributor, contractor, support, and other low-trust content roles that can save HTML, because stored XSS starts with write access to the editor workflow rather than privileged login alone.
What's in the full analysis
Corgea's full analysis covers the operational detail this post intentionally leaves for the source:
- Exact vulnerable package ranges and fix versions across npm, NuGet, and Composer
- Code-level examples of the data-mce-* and protected-comment paths involved in each CVE
- Detection queries for finding suspicious persisted HTML in CMS and SaaS content stores
- Remediation steps for teams that bundle TinyMCE through plugins, themes, or commercial admin components
👉 Read Corgea's analysis of TinyMCE stored XSS and admin console risk →
TinyMCE stored XSS in admin consoles: are your controls keeping up?
Explore further
20/08/2026 6:38 pm
Stored editor XSS is an identity problem because it turns content authorship into privilege abuse. A low-trust editor should not be able to inject executable script into a reviewer or administrator session, yet that is exactly what stored XSS enables when sanitisation fails. In IAM terms, the issue is not just application security but role trust boundaries. Any platform that lets one role author content for another role to render should treat editor output as untrusted until it passes a second, policy-aware validation step. Practitioners should think in terms of content-to-control-plane escalation, not just web payload filtering.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to The Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to The Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when a stored XSS finding affects an administrator workflow?
A: Contain it by patching the editor, removing stale low-trust authoring accounts, and reducing the administrator’s reachable blast radius. Then validate whether affected content already exists in production and whether browser-side mitigation such as strict Content Security Policy and tighter admin access segmentation can limit impact before the next review cycle.
👉 Read our full editorial: TinyMCE stored XSS exposes admin consoles to script injection
