tinymce/tinymce Security Advisories for 5.0.0 (14)
-
[HIGH] TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
PKSA-k4d6-bt7k-7ddp CVE-2026-47761 GHSA-vg35-5wq7-3x7w
Affected version: >=8.0.0,<8.5.1|>=6.0.0,<7.9.3|<5.11.1
Reported by:
GitHub -
[HIGH] TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
PKSA-2v47-9p8y-4qt3 CVE-2026-47762 GHSA-v98h-vmpc-fpqv
Affected version: >=8.0.0,<8.5.1|>=6.0.0,<7.9.3|<5.11.1
Reported by:
GitHub -
[HIGH] TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
PKSA-rf1b-835f-6yyv CVE-2026-47759 GHSA-q742-qvgc-gc2f
Affected version: >=8.0.0,<8.5.1|>=6.0.0,<7.9.3|<5.11.1
Reported by:
GitHub -
[MEDIUM] TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
PKSA-kxv7-w7hg-zj9k CVE-2024-38356 GHSA-9hcv-j9pv-qmph
Affected version: >=7.0.0,<7.2.0|>=6.0.0,<6.8.4|<5.11.0
Reported by:
GitHub -
[MEDIUM] TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
PKSA-g43k-cp2d-8zny CVE-2024-38357 GHSA-w9jx-4g6g-rp7x
Affected version: >=7.0.0,<7.2.0|>=6.0.0,<6.8.4|<5.11.0
Reported by:
GitHub -
[MEDIUM] TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
PKSA-s5r2-shvb-ydth CVE-2024-29203 GHSA-438c-3975-5x3f
Affected version: <6.8.1
Reported by:
GitHub -
[MEDIUM] TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
PKSA-hdg2-6rxt-d4qn CVE-2024-29881 GHSA-5359-pvf2-pw78
Affected version: <7.0.0
Reported by:
GitHub -
[MEDIUM] TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
PKSA-mymm-sn83-mbb2 CVE-2023-48219 GHSA-v626-r774-j7f8
Affected version: >=6.0.0,<6.7.3|<5.10.9
Reported by:
GitHub -
[MEDIUM] TinyMCE XSS vulnerability in notificationManager.open API
PKSA-m1dk-8wwc-991j CVE-2023-45819 GHSA-hgqx-r2hp-jr38
Affected version: <5.10.8|>=6.0.0,<6.7.1
Reported by:
GitHub -
[MEDIUM] TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin
PKSA-49mb-wskm-8m9m CVE-2023-45818 GHSA-v65r-p3vv-jjfv
Affected version: <5.10.8|>=6.0.0,<6.7.1
Reported by:
GitHub -
[MEDIUM] Cross-site scripting vulnerability in TinyMCE alerts
PKSA-t9cj-9h2r-fkgh CVE-2022-23494 GHSA-gg8r-xjwq-4w92
Affected version: <5.10.7|>=6.0.0,<6.3.1
Reported by:
GitHub -
[MEDIUM] Cross-site scripting vulnerability in TinyMCE plugins
PKSA-s6b9-gg3t-crbs CVE-2024-21910 GHSA-r8hm-w5f7-wj39
Affected version: <5.10.0
Reported by:
GitHub -
[MEDIUM] Cross-site scripting vulnerability in TinyMCE
PKSA-prcy-kppw-cnxf CVE-2024-21908 GHSA-5h9g-x5rv-25wg
Affected version: <5.9.0
Reported by:
GitHub -
[MEDIUM] Cross-site scripting vulnerability in TinyMCE
PKSA-gy5q-j464-j41z CVE-2024-21911 GHSA-w7jx-j77m-wp65
Affected version: <5.6.0
Reported by:
GitHub