Login Request a demo
TI
Product
tinymce
by tinymce · last CVE Oct 27, 2026
14
CVEs
0
On KEV
8.5
Max CVSS
1
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 0High 1Medium 11Low 0
Severity
All severities14Critical0High1Medium11Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add tinymce to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-116675
New
8.5
0%
Oct 27
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
Affected: >= 8.5.1, < 8.9.3; >= 7.9.3, < 7.9.4
CVE-2024-38357
6.1
1%
Jun 19
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Affected: < 5.11.0; >= 6.0.0, <6.8.4; >= 7.0.0, < 7.2.0
CVE-2024-38356
6.1
1%
Jun 19
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Affected: < 5.11.0; >= 6.0.0, <6.8.4; >= 7.0.0, < 7.2.0
CVE-2024-29881
6.1
1%
Mar 26
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
Affected: < 7.0.0
CVE-2024-29203
6.1
1%
Mar 26
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
Affected: < 6.8.1
CVE-2023-48219
6.1
1%
Nov 15
Special characters in unescaped text nodes can trigger mXSS in TinyMCE
Affected: >= 6.0.0 < 6.7.3; < 5.10.9
CVE-2023-45818
6.1
1%
Oct 19
Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin
Affected: < 5.10.8; >= 6.0.0, < 6.7.1
CVE-2023-45819
6.1
1%
Oct 19
Cross-site Scripting vulnerability in TinyMCE notificationManager.open API
Affected: < 5.10.8; >= 6.0.0, < 6.7.1
CVE-2026-47762
5.4
0%
May 28
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
Affected: < 5.11.1; >= 6.0.0, <= 6.8.6; >= 7.0.0, < 7.9.3; >= 8.0.0, < 8.5.1
CVE-2026-47761
5.4
0%
May 28
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
Affected: < 5.11.1; >= 6.0.0, <= 6.8.6; >= 7.0.0, < 7.9.3; >= 8.0.0, < 8.5.1
CVE-2026-47759
5.4
0%
May 28
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
Affected: < 5.11.1; >= 6.0.0, <= 6.8.6; >= 7.0.0, < 7.9.3; >= 8.0.0, < 8.5.1
CVE-2026-47760
5.4
0%
May 28
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Affected: >= 6.0.0, < 7.1.0
CVE-2012-4230
–
1%
Apr 25
The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to…
Affected: 3.5.8
CVE-2011-4825
–
39%
Dec 15
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before…
Affected: through 1.4.1
Showing 14