Tinymce
22 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Tinymce, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Tinymce CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 4 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 22 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High5
- Medium15
Latest CVEs
The 15 most recently published vulnerabilities affecting Tinymce.
- CVE-2026-47762TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments8.7
- CVE-2026-47761TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection8.7
- CVE-2026-47759TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes8.7
- CVE-2026-47760TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs8.7
- CVE-2024-38357TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements6.1
- CVE-2024-38356TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option6.1
- CVE-2024-29881TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements4.3
- CVE-2024-29203TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes4.3
- CVE-2024-21911Cross-site scripting vulnerability in TinyMCE6.1
- CVE-2024-21910Cross-site scripting vulnerability in TinyMCE plugins6.1
- CVE-2024-21908Cross-site scripting vulnerability in TinyMCE6.1
- CVE-2023-48219Special characters in unescaped text nodes can trigger mXSS in TinyMCE6.1
- CVE-2023-45818Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin6.1
- CVE-2023-45819Cross-site Scripting vulnerability in TinyMCE notificationManager.open API6.1
- CVE-2022-23494Cross-site scripting vulnerability in TinyMCE alerts5.4
Product grouping is registry-driven, with AI assist and human review. How it works