A stored cross-site scripting (XSS) vulnerability exists in the media plugin of TinyMCE. Attackers can inject malicious scripts via crafted data-mce-* attributes, which execute when the content is rendered. This affects users of TinyMCE with the media plugin enabled. The vulnerability has been patched in TinyMCE versions 8.5.1, 7.9.3, and 5.11.1 LTS. No official workaround is available other than upgrading to a fixed version.