Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

tinymce — Vulnerabilities & Security Advisories 13

All 13 CVE vulnerabilities found in tinymce, with AI-generated Chinese analysis, references, and POCs.

This page documents known weaknesses affecting the TinyMCE rich text editor, focusing on common vulnerability types and security tags. It aggregates data related to security flaws identified in the TinyMCE software ecosystem, ensuring a comprehensive view of its risk landscape. The collection covers vulnerabilities reported from the product’s initial releases through the present day, providing a historical context for security assessments. Here, researchers and developers can track vendor advisories issued by Tiny Technologies or community contributors to understand the timeline of fixes and disclosures. You can also gain a deeper understanding of specific weakness classes that have impacted the editor, such as cross-site scripting or injection flaws, by examining how these categories manifest within this specific software. Additionally, users can look up the vulnerability history of TinyMCE to review past incidents, assess the frequency of updates, and evaluate the overall security posture of the product over time. This resource serves as a neutral archive for security information, facilitating better decision-making for teams integrating TinyMCE into their applications. By centralizing this information, the page helps stakeholders identify patterns in defect resolution and maintain robust security practices. It is designed for clarity and utility, allowing quick reference to critical security data without unnecessary complexity or promotional content.

Vendor: tinymce

CVE ID Title CVSS Severity Published
CVE-2026-47762 TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments CWE-79 8.7 High 2026-05-28
CVE-2026-47761 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection CWE-79 8.7 High 2026-05-28
CVE-2026-47759 TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes CWE-79 8.7 High 2026-05-28
CVE-2026-47760 TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs CWE-79 8.7 High 2026-05-28
CVE-2024-38357 TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements CWE-79 6.1 Medium 2024-06-19
CVE-2024-38356 TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option CWE-79 6.1 Medium 2024-06-19
CVE-2024-29881 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements CWE-79 4.3 Medium 2024-03-26
CVE-2024-29203 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes CWE-79 4.3 Medium 2024-03-26
CVE-2023-48219 Special characters in unescaped text nodes can trigger mXSS in TinyMCE CWE-79 6.1 Medium 2023-11-15
CVE-2023-45818 Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin CWE-79 6.1 Medium 2023-10-19
CVE-2023-45819 Cross-site Scripting vulnerability in TinyMCE notificationManager.open API CWE-79 6.1 Medium 2023-10-19
CVE-2022-23494 Cross-site scripting vulnerability in TinyMCE alerts CWE-79 5.4 Medium 2022-12-08
CVE-2019-1010091 tinymce 跨站脚本漏洞 CWE-79 6.1 - 2019-07-17

All 13 known CVE vulnerabilities affecting tinymce with full Chinese analysis, references, and POCs where available.