Tinymce (Tiny) - vulnerabilities (CVEs)
16 CVEs, 0 in the last 30 days, 326 known versions, newest CVE from 2026-05-28. Vendor: Tiny.
CVEs of Tinymce
- CVE-2026-47759 - CVSS 8.7 (high), 2026-05-28: TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes…
- CVE-2026-47762 - CVSS 8.7 (high), 2026-05-28: TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows…
- CVE-2026-47761 - CVSS 8.7 (high), 2026-05-28: TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject…
- CVE-2026-47760 - CVSS 8.7 (high), 2026-05-28: TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling…
- CVE-2024-29881 - CVSS 6.1 (medium), 2024-03-26: TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code.…
- CVE-2024-29203 - CVSS 6.1 (medium), 2024-03-26: TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed…
- CVE-2024-21911 - CVSS 6.1 (medium), 2024-01-03: TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML…
- CVE-2024-21910 - CVSS 6.1 (medium), 2024-01-03: TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or…
- CVE-2024-21908 - CVSS 6.1 (medium), 2024-01-03: TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML…
- CVE-2023-48219 - CVSS 6.1 (medium), 2023-11-15: TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and…
- CVE-2023-45819 - CVSS 6.1 (medium), 2023-10-19: TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability…
- CVE-2023-45818 - CVSS 6.1 (medium), 2023-10-19: TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality.…
- CVE-2022-23494 - CVSS 6.1 (medium), 2022-12-08: tinymce is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were…
- CVE-2020-12648 - CVSS 6.1 (medium), 2020-08-14: A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic…
- CVE-2020-17480 - CVSS 6.1 (medium), 2020-08-10: TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert…
- CVE-2019-1010091 - CVSS 6.1 (medium), 2019-07-17: tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The…
