Ttinymce

Products

Exploited and recent CVEs

• CVE-2026-116675 High 8.5 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization 0.3%
• CVE-2026-47762 High 8.7 TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments 0.3%
• CVE-2026-47761 High 8.7 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection 0.3%
• CVE-2026-47759 High 8.7 TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes 0.3%
• CVE-2026-47760 High 8.7 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs 0.2%
• CVE-2024-38357 Medium 6.1 TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements 0.5%
• CVE-2024-38356 Medium 6.1 TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option 0.5%
• CVE-2024-29881 Medium 4.3 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements 0.7%
• CVE-2024-29203 Medium 4.3 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes 0.7%
• CVE-2023-48219 Medium 6.1 Special characters in unescaped text nodes can trigger mXSS in TinyMCE 0.7%
• CVE-2023-45818 Medium 6.1 Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin 0.8%
• CVE-2023-45819 Medium 6.1 Cross-site Scripting vulnerability in TinyMCE notificationManager.open API 0.6%
• CVE-2022-23494 Medium 5.4 Cross-site scripting vulnerability in TinyMCE alerts 1.0%