A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote…
Priority LOW 31CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.
Why it matters now
EPSS 0.01803 78th percentileScored 2026-11-07
Fix Fixed tinymce (npm): 4.9.11, 5.4.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | tinymce (npm) | before 4.9.11 | 4.9.11 | Patch available | GHSA-vrv8-v4w8-f95h |
| — | tinymce (npm) | 5.0.0 to before 5.4.1 | 5.4.1 | Patch available | GHSA-vrv8-v4w8-f95h |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- tinymce (npm) Vendor— Affected before 4.9.11 Fixed in 4.9.11 Patch available GHSA-vrv8-v4w8-f95h
- tinymce (npm) Vendor— Affected 5.0.0 to before 5.4.1 Fixed in 5.4.1 Patch available GHSA-vrv8-v4w8-f95h
Remediation
- Fix · GHSA-vrv8-v4w8-f95h tinymce (npm) Fixed in 4.9.11 Advisory →
- Fix · GHSA-vrv8-v4w8-f95h tinymce (npm) Fixed in 5.4.1 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2020-12648
- 2026-10-03 Alias added: GHSA-vrv8-v4w8-f95h
References
Other 6
- https://github.com/tinymce/tinymce/security/advisories/GHSA-vrv8-v4w8-f95h
- https://github.com/tinymce/tinymce/pull/5843
- https://github.com/tinymce/tinymce/commit/2b71c922214d388838d930806207a66c14e80f63
- https://github.com/tinymce/tinymce/commit/696e43658dc9750ec24fdc4650bd2be9653daf5b
- https://github.com/tinymce/tinymce
- https://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes
More Tinymce vulnerabilities
- TI-2026-35259 TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments CVSS 3.1HIGH 8.7
- TI-2026-35258 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection CVSS 3.1HIGH 8.7
- TI-2026-35256 TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes CVSS 3.1HIGH 8.7
- TI-2026-35257 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs CVSS 3.1HIGH 8.7
- TI-2024-14570 Cross-site scripting vulnerability in TinyMCE plugins CVSS 3.1MEDIUM 6.1
- TI-2019-15973 Cross-site scripting in tinymce CVSS 3.1MEDIUM 6.1
Sources
- CVE-2020-12648 · CVE Program
- CVE-2020-12648 · NVD
- FIRST EPSS
- GHSA-vrv8-v4w8-f95h · GitHub Advisory Database · CC BY 4.0
- CVE-2020-12648 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences