Tinymce

This hub aggregates every CVE we track for Tinymce, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Tinymce.

• CVE-2026-47762TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments8.7May 28, 2026
• CVE-2026-47761TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection8.7May 28, 2026
• CVE-2026-47759TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes8.7May 28, 2026
• CVE-2026-47760TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs8.7May 28, 2026
• CVE-2024-38357TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements6.1Jun 19, 2024
• CVE-2024-38356TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option6.1Jun 19, 2024
• CVE-2024-29881TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements4.3Mar 26, 2024
• CVE-2024-29203TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes4.3Mar 26, 2024
• CVE-2024-21911Cross-site scripting vulnerability in TinyMCE6.1Jan 3, 2024
• CVE-2024-21910Cross-site scripting vulnerability in TinyMCE plugins6.1Jan 3, 2024
• CVE-2024-21908Cross-site scripting vulnerability in TinyMCE6.1Jan 3, 2024
• CVE-2023-48219Special characters in unescaped text nodes can trigger mXSS in TinyMCE6.1Nov 15, 2023
• CVE-2023-45818Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin6.1Oct 19, 2023
• CVE-2023-45819Cross-site Scripting vulnerability in TinyMCE notificationManager.open API6.1Oct 19, 2023
• CVE-2022-23494Cross-site scripting vulnerability in TinyMCE alerts5.4Dec 8, 2022