CVE-2022-23494

Cross-site scripting vulnerability in TinyMCE alerts

Published: Dec 8, 2022Updated: Nov 21, 2024 Sources: CVE List NVD GHSACWE-79

5.4MEDIUM

Description

tinymce is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the `image` plugin, which presents these dialogs when certain errors occur. The vulnerability allowed arbitrary JavaScript execution when an alert presented in the TinyMCE UI for the current user. This vulnerability has been patched in TinyMCE 5.10.7 and TinyMCE 6.3.1 by ensuring HTML sanitization was still performed after unwrapping invalid elements. Users are advised to upgrade to either 5.10.7 or 6.3.1. Users unable to upgrade may ensure the the `images_upload_handler` returns a valid value as per the images_upload_handler documentation.

No summary for this CVE yet.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:LPrivileges Required

Low

UI:RUser Interaction

Required

Scope

S:CScope

Changed

Impact

C:LConfidentiality

Low

I:LIntegrity

Low

A:NAvailability

None

Open in CVSS calculator →

Weaknesses

CWE-79

Affected Products

tiny

oss-projectaka tinymce, moxiemanager, tinybrowser

tinymceLibrary

OSS Libraries / generic-library

package-ecosystem

package-ecosystem

package-ecosystem

commercialaka color picker, image manager

tinymceMixed

OSS Libraries / web-framework

Exploitability

Official Patch Available

Is your org exposed to CVE-2022-23494?We can run the check for you — a free external exposure review, no install. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques

Execution

Initial Access

View detailed technique mapping

References

https://github.com/tinymce/tinymce/commit/6923d85eba6de3e08ebc9c5a387b5abdaa21150e

github.com

https://github.com/tinymce/tinymce/commit/8bb2d2646d4e1a718fce61a775fa22e9d317b32d

github.com

https://github.com/tinymce/tinymce/security/advisories/GHSA-gg8r-xjwq-4w92

github.com

and 5 more references View all →

News mentions

Critical TinyMCE Cross Site Scripting Flaws Threaten Millions of Applications
en-us·Daily CyberSecurity (securityonline.info)·Jun 10, 2026 Patch TinyMCE web-app

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2022-23494 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows