tinymce

Top products

The 15 most recently published vulnerabilities affecting tinymce.

• CVE-2026-47762TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments8.7May 28, 2026
• CVE-2026-47761TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection8.7May 28, 2026
• CVE-2026-47759TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes8.7May 28, 2026
• CVE-2026-47760TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs8.7May 28, 2026
• CVE-2024-38357TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements6.1Jun 19, 2024
• CVE-2024-38356TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option6.1Jun 19, 2024
• CVE-2024-29881TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements4.3Mar 26, 2024
• CVE-2024-29203TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes4.3Mar 26, 2024
• CVE-2023-48219Special characters in unescaped text nodes can trigger mXSS in TinyMCE6.1Nov 15, 2023
• CVE-2023-45818Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin6.1Oct 19, 2023
• CVE-2023-45819Cross-site Scripting vulnerability in TinyMCE notificationManager.open API6.1Oct 19, 2023
• CVE-2022-23494Cross-site scripting vulnerability in TinyMCE alerts5.4Dec 8, 2022
• CVE-2019-1010091tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vec...6.1Jul 17, 2019
• CVE-2014-3845Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests th...6.8May 22, 2014
• CVE-2014-3844The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors. NOTE: some of these d...5.0May 22, 2014