[HIGH] TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

PKSA-2v47-9p8y-4qt3 CVE-2026-47762 GHSA-v98h-vmpc-fpqv

Affected package: tinymce/tinymce

Affected version: >=8.0.0,<8.5.1|>=6.0.0,<7.9.3|<5.11.1

Reported by:
GitHub