Tiny / Tinymce
16 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-47762 | TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments | HIGH | 8.7 | May 28, 2026 |
| CVE-2026-47761 | TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection | HIGH | 8.7 | May 28, 2026 |
| CVE-2026-47759 | TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes | HIGH | 8.7 | May 28, 2026 |
| CVE-2026-47760 | TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs | HIGH | 8.7 | May 28, 2026 |
| CVE-2024-29881 | TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements | MEDIUM | 6.1 | Mar 26, 2024 |
| CVE-2024-29203 | TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes | MEDIUM | 6.1 | Mar 26, 2024 |
| CVE-2024-21911 | Cross-site scripting vulnerability in TinyMCE | MEDIUM | 6.1 | Jan 3, 2024 |
| CVE-2024-21910 | Cross-site scripting vulnerability in TinyMCE plugins | MEDIUM | 6.1 | Jan 3, 2024 |
| CVE-2024-21908 | Cross-site scripting vulnerability in TinyMCE | MEDIUM | 6.1 | Jan 3, 2024 |
| CVE-2023-48219 | Special characters in unescaped text nodes can trigger mXSS in TinyMCE | MEDIUM | 6.1 | Nov 15, 2023 |
| CVE-2023-45818 | Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin | MEDIUM | 6.1 | Oct 19, 2023 |
| CVE-2023-45819 | Cross-site Scripting vulnerability in TinyMCE notificationManager.open API | MEDIUM | 6.1 | Oct 19, 2023 |
| CVE-2022-23494 | Cross-site scripting vulnerability in TinyMCE alerts | MEDIUM | 6.1 | Dec 8, 2022 |
| CVE-2020-12648 | A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editi… | MEDIUM | 6.1 | Aug 14, 2020 |
| CVE-2020-17480 | TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert… | MEDIUM | 6.1 | Aug 10, 2020 |
| CVE-2019-1010091 | tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The compo… | MEDIUM | 6.1 | Jul 17, 2019 |
Showing 1 to 16 of 16 CVEs