TI
Vendor
tinymce
19
CVEs
0
On KEV
1
New 30D
Products
TI8.5
tinymce
tinymce
14 CVEs0 on KEV1 new
CP–
Color Picker
Tinymce
2 CVEs0 on KEV0 new
IM–
Image Manager
Tinymce
1 CVEs0 on KEV0 new
ME–
Media
Tinymce
1 CVEs0 on KEV0 new
SP–
Spellchecker Php
Tinymce
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116675 New | TI tinymce tinymce | 8.5 | Oct 27 | TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization |
| CVE-2026-47762 | TI tinymce tinymce | 5.4 | May 28 | TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments |
| CVE-2026-47761 | TI tinymce tinymce | 5.4 | May 28 | TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection |
| CVE-2026-47759 | TI tinymce tinymce | 5.4 | May 28 | TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes |
| CVE-2026-47760 | TI tinymce tinymce | 5.4 | May 28 | TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs |
| CVE-2024-38357 | TI tinymce tinymce | 6.1 | Jun 19 | TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements |
| CVE-2024-38356 | TI tinymce tinymce | 6.1 | Jun 19 | TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option |
| CVE-2024-29881 | TI tinymce tinymce | 6.1 | Mar 26 | TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements |
| CVE-2024-29203 | TI tinymce tinymce | 6.1 | Mar 26 | TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes |
| CVE-2023-48219 | TI tinymce tinymce | 6.1 | Nov 15 | Special characters in unescaped text nodes can trigger mXSS in TinyMCE |
| CVE-2023-45818 | TI tinymce tinymce | 6.1 | Oct 19 | Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin |
| CVE-2023-45819 | TI tinymce tinymce | 6.1 | Oct 19 | Cross-site Scripting vulnerability in TinyMCE notificationManager.open API |
| CVE-2014-3845 | CP Color Picker Tinymce | – | May 22 | Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authentication of unspecified… |
| CVE-2014-3844 | CP Color Picker Tinymce | – | May 22 | The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors |
| CVE-2012-4230 | TI Tinymce Tinymce | – | Apr 25 | The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to… |
| CVE-2012-3414 | IM Image Manager Tinymce | – | Jul 19 | Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products,… |
| CVE-2013-2204 | ME Media Tinymce | – | Jul 8 | moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign)… |
| CVE-2012-6112 | SP Spellchecker Php Tinymce | – | Jan 27 | classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before… |
| CVE-2011-4825 | TI Tinymce Tinymce | – | Dec 15 | Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before… |