https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-47762.htmlhttps://patchthecve.com/cve/CVE-2026-47762.htmlWed, 14 Oct 2026 20:10:00 +0000HIGH 8.7: TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. This vhttps://patchthecve.com/cve/CVE-2026-47761.htmlhttps://patchthecve.com/cve/CVE-2026-47761.htmlWed, 14 Oct 2026 20:10:00 +0000HIGH 8.7: TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugihttps://patchthecve.com/cve/CVE-2026-47760.htmlhttps://patchthecve.com/cve/CVE-2026-47760.htmlWed, 14 Oct 2026 20:10:00 +0000HIGH 8.7: TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute sanitization and execute arbitrary JavaScript. This vulnerabilihttps://patchthecve.com/cve/CVE-2026-47759.htmlhttps://patchthecve.com/cve/CVE-2026-47759.htmlWed, 14 Oct 2026 20:10:00 +0000HIGH 8.7: TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypa