Vulnerabilities

TI-2026-35259 CVE-2026-47762 · GHSA-v98h-vmpc-fpqv

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

LOW 39

TinyMCE is an open source rich text editor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00281 Published 2026-05-28 Fixed in 5.11.1, 7.9.3 +1 CWE-79

TI-2026-35258 CVE-2026-47761 · GHSA-vg35-5wq7-3x7w

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

LOW 39

TinyMCE is an open source rich text editor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00264 Published 2026-05-28 Fixed in 5.11.1, 7.9.3 +1 CWE-79

TI-2026-35256 CVE-2026-47759 · GHSA-q742-qvgc-gc2f

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

LOW 39

TinyMCE is an open source rich text editor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00281 Published 2026-05-28 Fixed in 5.11.1, 7.9.3 +1 CWE-79

TI-2026-35257 CVE-2026-47760 · GHSA-mh5m-5hw4-5c69

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

LOW 37

TinyMCE is an open source rich text editor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00191 Published 2026-05-28 Fixed in 7.1.0 CWE-79

TI-2025-21442 CVE-2025-30091 · GHSA-fp8m-c995-8jh3

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer…

MEDIUM 44

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00787 Published 2025-03-25 Fixed in 4.0.0 CWE-96

TI-2024-19650 CVE-2024-29881 · GHSA-5359-pvf2-pw78

TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00713 Published 2024-03-26 Fixed in 7.0.0 CWE-79

TI-2024-19372 CVE-2024-29203 · GHSA-438c-3975-5x3f

TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00713 Published 2024-03-26 Fixed in 6.8.1 CWE-79

TI-2024-16232 CVE-2024-24701 · GHSA-crwp-2h3q-vwm3

WordPress Setka Editor Plugin <= 2.1.20 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Native Grid LLC A no-code page builder for beautiful performance-based content.This issue affects A no-code page builder for beautiful performance-based content: from n/…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00277 Published 2024-02-28 No fix listed CWE-352

TI-2024-14571 CVE-2024-21911 · GHSA-w7jx-j77m-wp65

Cross-site scripting vulnerability in TinyMCE

LOW 30

TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01165 Published 2024-01-03 Fixed in 5.6.0 CWE-79

TI-2024-14570 CVE-2024-21910 · GHSA-r8hm-w5f7-wj39

Cross-site scripting vulnerability in TinyMCE plugins

LOW 31

TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00956 Published 2024-01-03 Fixed in 5.10.0, 3.4.0 CWE-79

TI-2024-14568 CVE-2024-21908 · GHSA-5h9g-x5rv-25wg

Cross-site scripting vulnerability in TinyMCE

LOW 29

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01066 Published 2024-01-03 Fixed in 5.9.0 CWE-79

TI-2023-26083 CVE-2023-48219 · GHSA-v626-r774-j7f8

Special characters in unescaped text nodes can trigger mXSS in TinyMCE

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00715 Published 2023-11-15 Fixed in 5.10.9, 6.7.3 CWE-79

TI-2023-24578 CVE-2023-45818 · GHSA-v65r-p3vv-jjfv

Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin

LOW 29

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00759 Published 2023-10-19 Fixed in 5.10.8, 6.7.1 CWE-79

TI-2023-24579 CVE-2023-45819 · GHSA-hgqx-r2hp-jr38

Cross-site Scripting vulnerability in TinyMCE notificationManager.open API

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00634 Published 2023-10-19 Fixed in 5.10.8, 6.7.1 CWE-79

TI-2022-07553 CVE-2022-23494 · GHSA-gg8r-xjwq-4w92

Cross-site scripting vulnerability in TinyMCE alerts

LOW 29

tinymce is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01015 Published 2022-12-08 Fixed in 5.10.7, 6.3.1 CWE-79

TI-2021-06163 CVE-2021-23562 · GHSA-rp2c-jrgp-cvr8

Arbitrary file upload in plupload

MEDIUM 40

This affects the package plupload before 2.3.9.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01026 Published 2021-12-03 Fixed in 2.3.9 CWE-434

TI-2020-10058 CVE-2020-12648 · GHSA-vrv8-v4w8-f95h

A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote…

LOW 31

A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01803 Published 2020-08-14 Fixed in 4.9.11, 5.4.1 CWE-79

TI-2020-13238 CVE-2020-17480 · GHSA-27gm-ghr9-4v95

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste…

LOW 30

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01248 Published 2020-08-10 Fixed in 4.9.7, 5.1.4 CWE-79

TI-2011-04222 CVE-2011-4908 · GHSA-2cvc-p4v7-3gpx

TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.

HIGH 75

TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.55769 Published 2020-02-12 No fix listed CWE-434

TI-2011-04220 CVE-2011-4906 · GHSA-7v56-j653-c26v

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.

MEDIUM 54

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.09582 Published 2020-02-12 No fix listed CWE-434

TI-2019-15973 CVE-2019-1010091 · GHSA-c78w-2gw7-gjv3

Cross-site scripting in tinymce

LOW 31

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01917 Published 2019-07-17 Fixed in 4.9.10, 5.2.2 CWE-79

TI-2019-07348 CVE-2019-10012 · GHSA-ppjq-m4gx-9pj8

Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload…

LOW 36

Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a ZIP archive and using the MoxieManager (for .NET) plugin before 2.1.4 in the mox…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.01592 Published 2019-03-25 No fix listed CWE-434

Vulnerabilities

Filters