Priority MEDIUM 60
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allow…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.39162 · Published 2011-12-15 · No fix listed CWE-94
Priority LOW 39
TinyMCE is an open source rich text editor.
CVSS 4.0HIGH 8.5· Network · Low privileges · User interaction · EPSS 0.00349 · Published 2026-10-27 · Fixed in 8.9.3, 7.9.4 CWE-79
Priority LOW 39
TinyMCE is an open source rich text editor.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.00281 · Published 2026-05-28 · Fixed in 5.11.1, 7.9.3 +1 CWE-79
Priority LOW 39
TinyMCE is an open source rich text editor.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.00264 · Published 2026-05-28 · Fixed in 5.11.1, 7.9.3 +1 CWE-79
Priority LOW 39
TinyMCE is an open source rich text editor.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.00281 · Published 2026-05-28 · Fixed in 5.11.1, 7.9.3 +1 CWE-79
Priority LOW 37
TinyMCE is an open source rich text editor.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.00191 · Published 2026-05-28 · Fixed in 7.1.0 CWE-79
Priority LOW 32
Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change plugin settin…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.00952 · Published 2014-05-22 · No fix listed CWE-352
Priority LOW 32
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary we…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.09412 · Published 2013-07-19 · No fix listed CWE-79
Priority LOW 31
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01917 · Published 2019-07-17 · Fixed in 4.9.10, 5.2.2 CWE-79
Priority LOW 29
TinyMCE is an open source rich text editor.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00759 · Published 2023-10-19 · Fixed in 5.10.8, 6.7.1 CWE-79
Priority LOW 29
tinymce is an open source rich text editor.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01015 · Published 2022-12-08 · Fixed in 5.10.7, 6.3.1 CWE-79
Priority LOW 28
TinyMCE is an open source rich text editor.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00529 · Published 2024-06-19 · Fixed in 5.11.0, 6.8.4 +2 CWE-79
Priority LOW 28
TinyMCE is an open source rich text editor.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00529 · Published 2024-06-19 · Fixed in 5.11.0, 6.8.4 +2 CWE-79
Priority LOW 28
TinyMCE is an open source rich text editor.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00713 · Published 2024-03-26 · Fixed in 7.0.0 CWE-79
Priority LOW 28
TinyMCE is an open source rich text editor.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00713 · Published 2024-03-26 · Fixed in 6.8.1 CWE-79
Priority LOW 28
TinyMCE is an open source rich text editor.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00715 · Published 2023-11-15 · Fixed in 5.10.9, 6.7.3 CWE-79
Priority LOW 28
TinyMCE is an open source rich text editor.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00634 · Published 2023-10-19 · Fixed in 5.10.8, 6.7.1 CWE-79
Priority LOW 27
classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.02288 · Published 2013-01-27 · Fixed in 2.1.10, 2.2.7 +2 CWE-264
Priority LOW 26
The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.01784 · Published 2014-05-22 · No fix listed CWE-264
Priority LOW 25
moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRIN…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.02904 · Published 2013-07-08 · No fix listed CWE-20
Priority LOW 23
The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to conduct cross-site scripting (XSS) attac…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.0139 · Published 2014-04-25 · No fix listed CWE-264
THREATIST.IORead the docs