TinyMCE versions up to 5.10.9, from 6.0.0 up to but not including 7.9.3, and from 8.0.0 up to but not including 8.5.1 are affected by a stored Cross-Site Scripting (XSS) vulnerability. The issue arises from unsanitized data-mce-* attributes (specifically data-mce-href, data-mce-src, and data-mce-style) that allow attackers to inject malicious content bypassing validation during serialization. This vulnerability has been patched by stripping unsafe data-mce-* attributes during parsing. Users should upgrade to TinyMCE 8.5.1 or higher, 7.9.3 or higher, or 5.11.1 LTS or higher (the latter available only under commercial long-term support). No official workaround is available.