tinymce/tinymce vulnerabilities (Packagist)

16 vulnerabilities.

• tinymce/tinymce Packagist TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization CVE-2026-116675 Fix available 8.5 HighOctober 27, 2026
• tinymce/tinymce Packagist TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments CVE-2026-47762 Fix available 8.7 HighMay 28, 2026
• tinymce/tinymce Packagist TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection CVE-2026-47761 Public exploitFix available 8.7 HighMay 28, 2026
• tinymce/tinymce Packagist TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes CVE-2026-47759 Fix available 8.7 HighMay 28, 2026
• tinymce/tinymce Packagist TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs CVE-2026-47760 Fix available 8.7 HighMay 28, 2026
• tinymce/tinymce Packagist TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements CVE-2024-38357 Fix available 6.1 MediumMay 28, 2021
• tinymce/tinymce Packagist TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option CVE-2024-38356 Fix available 6.1 MediumMay 28, 2021
• tinymce/tinymce Packagist TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements CVE-2024-29881 Fix available 4.3 MediumMay 28, 2021
• tinymce/tinymce Packagist TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes CVE-2024-29203 Fix available 4.3 MediumMay 28, 2021
• tinymce/tinymce Packagist Cross-site scripting vulnerability in TinyMCE plugins CVE-2024-21910 Fix available 6.1 MediumMay 28, 2021
• tinymce/tinymce Packagist Cross-site scripting vulnerability in TinyMCE CVE-2024-21908 Fix available 6.1 MediumMay 28, 2021
• tinymce/tinymce Packagist Special characters in unescaped text nodes can trigger mXSS in TinyMCE CVE-2023-48219 Fix available 6.1 MediumMay 28, 2021
• tinymce/tinymce Packagist Cross-site Scripting vulnerability in TinyMCE notificationManager.open API CVE-2023-45819 Fix available 6.1 MediumMay 28, 2021
• tinymce/tinymce Packagist Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin CVE-2023-45818 Fix available 6.1 MediumMay 28, 2021
• tinymce/tinymce Packagist Cross-site scripting vulnerability in TinyMCE alerts CVE-2022-23494 Fix available 5.4 MediumMay 28, 2021
• tinymce/tinymce Packagist Cross-site scripting vulnerability in TinyMCE CVE-2024-21911 Fix available 6.1 MediumJanuary 6, 2021