What’s Vulnerable › Products

tinymce vulnerabilities

18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your tinymce version is affected

Latest tinymce vulnerabilities

• CVE-2026-116675 — TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization (CVSS 8.5)
• CVE-2026-47762 — TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments (CVSS 5.4)
• CVE-2026-47761 — TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection (CVSS 5.4)
• CVE-2026-47760 — TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs (CVSS 5.4)
• CVE-2026-47759 — TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes (CVSS 5.4)
• CVE-2024-38357 — TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements (CVSS 6.1)
• CVE-2024-38356 — TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option (CVSS 6.1)
• CVE-2024-29881 — TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements (CVSS 6.1)
• CVE-2024-29203 — TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes (CVSS 6.1)
• CVE-2024-21911 — Cross-site scripting vulnerability in TinyMCE (CVSS 6.1)
• CVE-2024-21910 — Cross-site scripting vulnerability in TinyMCE plugins (CVSS 6.1)
• CVE-2024-21908 — Cross-site scripting vulnerability in TinyMCE (CVSS 6.1)
• CVE-2023-48219 — Special characters in unescaped text nodes can trigger mXSS in TinyMCE (CVSS 6.1)
• CVE-2023-45819 — Cross-site Scripting vulnerability in TinyMCE notificationManager.open API (CVSS 6.1)
• CVE-2023-45818 — Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin (CVSS 6.1)
• CVE-2022-23494 — Cross-site scripting vulnerability in TinyMCE alerts (CVSS 6.1)
• CVE-2020-12648 — (CVSS 6.1)
• CVE-2020-17480 — (CVSS 6.1)
• CVE-2019-1010091 — (CVSS 6.1)