CVE-2026-47762 | High | 8.7 | 2026-05-28 | TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows at… |
CVE-2026-47761 | High | 8.7 | 2026-05-28 | TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject ma… |
CVE-2026-47760 | High | 8.7 | 2026-05-28 | TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling i… |
CVE-2026-47759 | High | 8.7 | 2026-05-28 | TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes (data-… |
CVE-2024-38357 | Medium | 6.1 | 2024-06-19 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially… |
CVE-2024-38356 | Medium | 6.1 | 2024-06-19 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the `non… |
CVE-2024-29881 | Medium | 4.3 | 2024-03-26 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code… |
CVE-2024-29203 | Medium | 4.3 | 2024-03-26 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `ifram… |
CVE-2023-48219 | Medium | 6.1 | 2023-11-15 | TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and o… |
CVE-2023-45819 | Medium | 6.1 | 2023-10-19 | TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability… |
CVE-2023-45818 | Medium | 6.1 | 2023-10-19 | TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality… |
CVE-2022-23494 | Medium | 5.4 | 2022-12-08 | tinymce is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were… |
CVE-2019-1010091 | Medium | 6.1 | 2019-07-17 | tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The compo… |
CVE-2014-3845 | | | 2014-05-22 | Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authenticatio… |
CVE-2014-3844 | | | 2014-05-22 | The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspe… |
CVE-2012-4230 | | | 2014-04-25 | The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which… |
CVE-2012-3414 | | | 2013-07-19 | Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and o… |
CVE-2013-2204 | | | 2013-07-08 | moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a… |
CVE-2012-6112 | | | 2013-01-27 | classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before… |
CVE-2011-4825 | | | 2011-12-15 | Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2… |