TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection (CVE-2026-47761) | HOL Guard CVE