[HIGH] TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

PKSA-2v47-9p8y-4qt3 CVE-2026-47762 GHSA-v98h-vmpc-fpqv

Affected package: tinymce/tinymce

Affected version: <=5.10.9|>=8.0.0,<8.5.1|>=6.0.0,<7.9.3

Reported by:
GitHub