Tinymce vulnerabilities

Products

• Tinymce 16
• Color Picker 2

Newest

• tinymce TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization CVE-2026-116675 Fix available 8.5 HighOctober 27, 2026
• tiny tinymce TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments CVE-2026-47762 Fix available 8.7 HighMay 28, 2026
• tiny tinymce TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection CVE-2026-47761 Public exploitFix available 8.7 HighMay 28, 2026
• tiny tinymce TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes CVE-2026-47759 Fix available 8.7 HighMay 28, 2026
• tiny tinymce TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs CVE-2026-47760 Fix available 8.7 HighMay 28, 2026
• tinymce TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements CVE-2024-38357 Fix available 6.1 MediumMay 28, 2021
• tinymce TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option CVE-2024-38356 Fix available 6.1 MediumMay 28, 2021
• tiny tinymce TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements CVE-2024-29881 Fix available 4.3 MediumMay 28, 2021
• tiny tinymce TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes CVE-2024-29203 Fix available 4.3 MediumMay 28, 2021
• tiny tinymce Special characters in unescaped text nodes can trigger mXSS in TinyMCE CVE-2023-48219 Fix available 6.1 MediumMay 28, 2021
• tiny tinymce Cross-site Scripting vulnerability in TinyMCE notificationManager.open API CVE-2023-45819 Fix available 6.1 MediumMay 28, 2021
• tiny tinymce Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin CVE-2023-45818 Fix available 6.1 MediumMay 28, 2021
• tiny tinymce Cross-site scripting vulnerability in TinyMCE alerts CVE-2022-23494 Fix available 5.4 MediumMay 28, 2021
• tiny tinymce XSS in TinyMCE CVE-2019-1010091 Fix available 6.1 MediumJuly 17, 2019
• tinymce color picker Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for... CVE-2014-3845 6.8 MediumMay 22, 2014
• tinymce color picker The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions,... CVE-2014-3844 5.0 MediumMay 22, 2014
• tinymce The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the ... CVE-2012-4230 4.3 MediumApril 25, 2014
• swfupload project swfupload, tinymce image manager, wordpress +2 more Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as... CVE-2012-3414 Public exploitFix available 4.3 MediumJuly 19, 2013
• tinymce media, wordpress +1 more moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before... CVE-2013-2204 Fix available 4.3 MediumJuly 1, 2013
• moodle, tinymce spellchecker php +1 more PHP Spellchecker addon for TinyMCE allows attackers to trigger arbitrary outbound HTTP requests CVE-2012-6112 Fix available 5.0 MediumJanuary 27, 2013
• phpletter ajax file and image manager, phpmyfaq, tinymce +2 more Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager... CVE-2011-4825 Public exploit EPSS 39.2% 7.5 HighDecember 15, 2011