tinymce vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20221
3. 20233
4. 20244
5. 20265

Newest CVEs

• CVE-2026-116675

  TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

  tinymce · tinymce

  High8.5
• CVE-2026-47762

  TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

  tinymce · tinymce

  High8.7
• CVE-2026-47761

  TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

  tinymce · tinymce

  High8.7
• CVE-2026-47759

  TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

  tinymce · tinymce

  High8.7
• CVE-2026-47760

  TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

  tinymce · tinymce

  High8.7
• CVE-2024-38357

  TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

  tinymce · tinymce

  Medium6.1
• CVE-2024-38356

  TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

  tinymce · tinymce

  Medium6.1
• CVE-2024-29881

  TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements

  tinymce · tinymce

  Medium4.3
• CVE-2024-29203

  TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes

  tinymce · tinymce

  Medium4.3
• CVE-2023-48219

  Special characters in unescaped text nodes can trigger mXSS in TinyMCE

  tinymce · tinymce

  Medium6.1