TI
Product
tinymce
7
CVEs
0
On KEV
8.5
Max CVSS
1
New 30D
Severity mix
Critical 0High 1Medium 4Low 0
Watch
Add tinymce to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-116675 New | 8.5 | Oct 27 | TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization Affected: >= 8.5.1, < 8.9.3; >= 7.9.3, < 7.9.4 |
| CVE-2026-47762 | 5.4 | May 28 | TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments Affected: < 5.11.1; >= 6.0.0, <= 6.8.6; >= 7.0.0, < 7.9.3; >= 8.0.0, < 8.5.1 |
| CVE-2026-47761 | 5.4 | May 28 | TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection Affected: < 5.11.1; >= 6.0.0, <= 6.8.6; >= 7.0.0, < 7.9.3; >= 8.0.0, < 8.5.1 |
| CVE-2026-47759 | 5.4 | May 28 | TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes Affected: < 5.11.1; >= 6.0.0, <= 6.8.6; >= 7.0.0, < 7.9.3; >= 8.0.0, < 8.5.1 |
| CVE-2026-47760 | 5.4 | May 28 | TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs Affected: >= 6.0.0, < 7.1.0 |
| CVE-2012-4230 | – | Apr 25 | The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to… Affected: 3.5.8 |
| CVE-2011-4825 | – | Dec 15 | Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before… Affected: through 1.4.1 |
Showing 7