Tiny Tinymce
16 CVEs affecting Tiny Tinymce. Latest disclosed: 2026-05-28. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47762 | High | 8.7 | 2026-05-28 | TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows at… |
CVE-2026-47761 | High | 8.7 | 2026-05-28 | TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject ma… |
CVE-2026-47760 | High | 8.7 | 2026-05-28 | TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling i… |
CVE-2026-47759 | High | 8.7 | 2026-05-28 | TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes (data-… |
CVE-2024-21911 | Medium | 6.1 | 2024-01-03 | TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML int… |
CVE-2024-21910 | Medium | 6.1 | 2024-01-03 | TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or lin… |
CVE-2024-21908 | Medium | 6.1 | 2024-01-03 | TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML int… |
CVE-2023-48219 | Medium | 6.1 | 2023-11-15 | TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and o… |
CVE-2023-45819 | Medium | 6.1 | 2023-10-19 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability… |
CVE-2023-45818 | Medium | 6.1 | 2023-10-19 | TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality… |
CVE-2020-12648 | Medium | 6.1 | 2020-08-14 | A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editi… |
CVE-2020-17480 | Medium | 6.1 | 2020-08-10 | TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert… |
CVE-2019-1010091 | Medium | 6.1 | 2019-07-17 | tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The compo… |
CVE-2022-23494 | Medium | 5.4 | 2022-12-08 | tinymce is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were… |
CVE-2024-29881 | Medium | 4.3 | 2024-03-26 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code… |
CVE-2024-29203 | Medium | 4.3 | 2024-03-26 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `ifram… |