Vulnerabilities

TI-2026-81439 CVE-2026-116675 · GHSA-mf2p-h6hf-fcwm

Cross-site scripting in TinyMCE media plugin via data-mce-object

LOW 39

TinyMCE is an open source rich text editor.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00349 Published 2026-10-27 Fixed in 8.9.3, 7.9.4 CWE-79

TI-2026-35259 CVE-2026-47762 · GHSA-v98h-vmpc-fpqv

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

LOW 39

TinyMCE is an open source rich text editor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00281 Published 2026-05-28 Fixed in 5.11.1, 7.9.3 +1 CWE-79

TI-2026-35258 CVE-2026-47761 · GHSA-vg35-5wq7-3x7w

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

LOW 39

TinyMCE is an open source rich text editor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00264 Published 2026-05-28 Fixed in 5.11.1, 7.9.3 +1 CWE-79

TI-2026-35256 CVE-2026-47759 · GHSA-q742-qvgc-gc2f

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

LOW 39

TinyMCE is an open source rich text editor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00281 Published 2026-05-28 Fixed in 5.11.1, 7.9.3 +1 CWE-79

TI-2026-35257 CVE-2026-47760 · GHSA-mh5m-5hw4-5c69

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

LOW 37

TinyMCE is an open source rich text editor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00191 Published 2026-05-28 Fixed in 7.1.0 CWE-79

TI-2024-25615 CVE-2024-38357 · GHSA-w9jx-4g6g-rp7x

TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00529 Published 2024-06-19 Fixed in 5.11.0, 6.8.4 +2 CWE-79

TI-2024-25614 CVE-2024-38356 · GHSA-9hcv-j9pv-qmph

TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00529 Published 2024-06-19 Fixed in 5.11.0, 6.8.4 +2 CWE-79

TI-2024-19650 CVE-2024-29881 · GHSA-5359-pvf2-pw78

TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00713 Published 2024-03-26 Fixed in 7.0.0 CWE-79

TI-2024-19372 CVE-2024-29203 · GHSA-438c-3975-5x3f

TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00713 Published 2024-03-26 Fixed in 6.8.1 CWE-79

TI-2023-26083 CVE-2023-48219 · GHSA-v626-r774-j7f8

Special characters in unescaped text nodes can trigger mXSS in TinyMCE

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00715 Published 2023-11-15 Fixed in 5.10.9, 6.7.3 CWE-79

TI-2023-24578 CVE-2023-45818 · GHSA-v65r-p3vv-jjfv

Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin

LOW 29

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00759 Published 2023-10-19 Fixed in 5.10.8, 6.7.1 CWE-79

TI-2023-24579 CVE-2023-45819 · GHSA-hgqx-r2hp-jr38

Cross-site Scripting vulnerability in TinyMCE notificationManager.open API

LOW 28

TinyMCE is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00634 Published 2023-10-19 Fixed in 5.10.8, 6.7.1 CWE-79

TI-2022-07553 CVE-2022-23494 · GHSA-gg8r-xjwq-4w92

Cross-site scripting vulnerability in TinyMCE alerts

LOW 29

tinymce is an open source rich text editor.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01015 Published 2022-12-08 Fixed in 5.10.7, 6.3.1 CWE-79

TI-2019-15973 CVE-2019-1010091 · GHSA-c78w-2gw7-gjv3

Cross-site scripting in tinymce

LOW 31

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01917 Published 2019-07-17 Fixed in 4.9.10, 5.2.2 CWE-79

TI-2014-03123 CVE-2014-3845 · GHSA-2gwv-7wq2-wv5g

Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before…

LOW 32

Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change plugin settin…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.00952 Published 2014-05-22 No fix listed CWE-352

TI-2014-03122 CVE-2014-3844 · GHSA-994w-w8hc-gp27

The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check…

LOW 26

The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01784 Published 2014-05-22 No fix listed CWE-264

TI-2012-03612 CVE-2012-4230 · GHSA-qwvc-vq5g-8cxv

The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy…

LOW 23

The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to conduct cross-site scripting (XSS) attac…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0139 Published 2014-04-25 No fix listed CWE-264

TI-2012-02944 CVE-2012-3414 · GHSA-89mv-5c9h-c8f7

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and…

LOW 32

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary we…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.09412 Published 2013-07-19 No fix listed CWE-79

TI-2013-01970 CVE-2013-2204 · GHSA-qm3h-34vf-g6fh

moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress…

LOW 25

moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRIN…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02904 Published 2013-07-08 No fix listed CWE-20

TI-2012-05076 CVE-2012-6112 · GHSA-fx5h-3786-h2w6

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before…

LOW 27

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02288 Published 2013-01-27 Fixed in 2.1.10, 2.2.7 +2 CWE-264

TI-2011-04153 CVE-2011-4825 · GHSA-4x3h-v693-hw3m

Static code injection vulnerability in inc/function.base.php in Ajax File and Image…

MEDIUM 60

Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allow…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.39162 Published 2011-12-15 No fix listed CWE-94

Vulnerabilities

Filters