# TinyMCE stored cross-site scripting in schema validation

Source: https://junglewise.ai/threats/tinymce-stored-cross-site-scripting-in-schema-validation-74691836  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · CVSS 6.1 · Published 2024-01-03

TinyMCE is a widely-used JavaScript rich-text editor embedded in web applications. A vulnerability in its schema validation logic allows an attacker to insert malicious HTML via the editor clipboard or APIs, which executes as JavaScript in other users' browsers. If server-side sanitization is not in place, published content could carry malicious scripts.

Technologies: [tinymce (npm)](https://junglewise.ai/threats/technologies/tinymce). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, with a CVSS score of 6.1, published 3 January 2024.

**Which products and versions are affected?** tinymce (npm) SEMVER:introduced=0,fixed=5.9.0.

**Is there a fix for This vulnerability?** Yes. tinymce (npm): upgrade to 5.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run tinymce (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tinymce (npm): upgrade to 5.9.0 or later

  ```sh
  npm install tinymce@5.9.0
  ```


## Technical details

A cross-site scripting (XSS) vulnerability exists in TinyMCE's core parser schema validation logic (CWE-79). An unauthenticated remote attacker can craft HTML content and insert it via the clipboard or editor APIs; the parser fails to properly validate this content after unwrapping invalid elements, allowing arbitrary JavaScript execution. User interaction is required (inserting the malicious content into the editor). The vulnerability affects TinyMCE versions before 5.9.0 and is patched in 5.9.0 by ensuring schema validation occurs after element unwrapping. Workarounds include manual content sanitization via the BeforeSetContent event.

## Affected products

- Tiny Technologies TinyMCE before 5.9.0

## Timeline

- 2021-10-21: disclosed: Published as GHSA-5h9g-x5rv-25wg; GHSA-gjhc-6xm7-mc8q is a duplicate advisory published 2024-01-03
- 2021-10-21: patched: Version 5.9.0 released with patch

## References

- [https://github.com/tinymce/tinymce/security/advisories/GHSA-5h9g-x5rv-25wg](https://github.com/tinymce/tinymce/security/advisories/GHSA-5h9g-x5rv-25wg)

## Related threats

- [TinyMCE media plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116675-tinymce-is-an-open-source-rich-text-editor-from-7-9-3-until-7-9)
- [PYSEC-2026-1301 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option](https://junglewise.ai/threats/cve-2024-38356-tinymce-cross-site-scripting-in-noneditable-regexp)
- [PYSEC-2026-1302 - TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements](https://junglewise.ai/threats/cve-2024-38357-tinymce-cross-site-scripting-in-noscript-element-parsing)
- [PYSEC-2026-632 - Cross-site scripting vulnerability in TinyMCE plugins](https://junglewise.ai/threats/cve-2024-21910-tinymce-cross-site-scripting-in-image-and-link-plugins)
- [Tiny Technologies TinyMCE stored XSS via forged mce:protected comments](https://junglewise.ai/threats/cve-2026-47762-tiny-technologies-tinymce-stored-xss-via-forged-mce-protected)