Tiny

Records22All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

Tiny records in CISA KEV

No Tiny vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Tinymce 16 records LOW Tinybrowser 2 records HIGH Moxiemanager 1 record LOW Plupload 1 record MEDIUM Setka Workflow 1 record LOW

Records

16 records in Tinymce · all components

TI-2026-35259 CVE-2026-47762 · GHSA-v98h-vmpc-fpqv

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

LOW 39

TinyMCE is an open source rich text editor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00281 Published 2026-05-28 Fixed in 5.11.1, 7.9.3 +1 CWE-79

TI-2026-35258 CVE-2026-47761 · GHSA-vg35-5wq7-3x7w

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

LOW 39

TinyMCE is an open source rich text editor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00264 Published 2026-05-28 Fixed in 5.11.1, 7.9.3 +1 CWE-79

TI-2026-35256 CVE-2026-47759 · GHSA-q742-qvgc-gc2f

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

LOW 39

TinyMCE is an open source rich text editor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00281 Published 2026-05-28 Fixed in 5.11.1, 7.9.3 +1 CWE-79

TI-2026-35257 CVE-2026-47760 · GHSA-mh5m-5hw4-5c69

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

LOW 37

TinyMCE is an open source rich text editor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00191 Published 2026-05-28 Fixed in 7.1.0 CWE-79

TI-2024-14570 CVE-2024-21910 · GHSA-r8hm-w5f7-wj39

Cross-site scripting vulnerability in TinyMCE plugins

LOW 31

TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00956 Published 2024-01-03 Fixed in 5.10.0, 3.4.0 CWE-79

TI-2020-10058 CVE-2020-12648 · GHSA-vrv8-v4w8-f95h

A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote…

LOW 31

A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01803 Published 2020-08-14 Fixed in 4.9.11, 5.4.1 CWE-79

TI-2019-15973 CVE-2019-1010091 · GHSA-c78w-2gw7-gjv3

Cross-site scripting in tinymce

LOW 31

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01917 Published 2019-07-17 Fixed in 4.9.10, 5.2.2 CWE-79

TI-2024-14571 CVE-2024-21911 · GHSA-w7jx-j77m-wp65

Cross-site scripting vulnerability in TinyMCE

LOW 30

TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01165 Published 2024-01-03 Fixed in 5.6.0 CWE-79

TI-2020-13238 CVE-2020-17480 · GHSA-27gm-ghr9-4v95

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste…

LOW 30

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01248 Published 2020-08-10 Fixed in 4.9.7, 5.1.4 CWE-79

TI-2024-14568 CVE-2024-21908 · GHSA-5h9g-x5rv-25wg

Cross-site scripting vulnerability in TinyMCE

LOW 29

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01066 Published 2024-01-03 Fixed in 5.9.0 CWE-79

TI-2023-24578 CVE-2023-45818 · GHSA-v65r-p3vv-jjfv

Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin

LOW 29

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00759 Published 2023-10-19 Fixed in 5.10.8, 6.7.1 CWE-79

TI-2022-07553 CVE-2022-23494 · GHSA-gg8r-xjwq-4w92

Cross-site scripting vulnerability in TinyMCE alerts

LOW 29

tinymce is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01015 Published 2022-12-08 Fixed in 5.10.7, 6.3.1 CWE-79

TI-2024-19650 CVE-2024-29881 · GHSA-5359-pvf2-pw78

TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00713 Published 2024-03-26 Fixed in 7.0.0 CWE-79

TI-2024-19372 CVE-2024-29203 · GHSA-438c-3975-5x3f

TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00713 Published 2024-03-26 Fixed in 6.8.1 CWE-79

TI-2023-26083 CVE-2023-48219 · GHSA-v626-r774-j7f8

Special characters in unescaped text nodes can trigger mXSS in TinyMCE

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00715 Published 2023-11-15 Fixed in 5.10.9, 6.7.3 CWE-79

TI-2023-24579 CVE-2023-45819 · GHSA-hgqx-r2hp-jr38

Cross-site Scripting vulnerability in TinyMCE notificationManager.open API

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00634 Published 2023-10-19 Fixed in 5.10.8, 6.7.1 CWE-79

Open these records in search →

Critical	3
High	7
Medium	12
Low	0
No CVSS	0