A stored Cross-Site Scripting (XSS) vulnerability exists in the media plugin of TinyMCE. This flaw allows attackers to inject malicious scripts via elements crafted through the data-mce-object attribute, which are executed before proper sanitization. The vulnerability affects TinyMCE versions 7.9.3 and 8.5.1 up to but not including 7.9.4 and 8.9.3 respectively. It has been patched in TinyMCE 7.9.4 and 8.9.3. No official workaround is available other than upgrading.