CVE-2024-29881

< 6.8.1

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content load

4.3MEDIUM

CVE-2024-29203

< 6.8.1

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content inse

4.3MEDIUM

CVE-2024-21911

< 5.6.0

TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker

6.1MEDIUM

CVE-2024-21910

< 5.10.0

TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could i

6.1MEDIUM

CVE-2024-21908

< 5.9.0

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker

6.1MEDIUM

CVE-2023-48219

< 5.10.9

TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s cor

6.1MEDIUM

CVE-2023-45819

< 5.10.8

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification

6.1MEDIUM

CVE-2023-45818

< 5.10.8

TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s cor

6.1MEDIUM

CVE-2022-23494

< 5.10.7

tinymce is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dia

5.4MEDIUM

CVE-2020-12648

< 4.9.11

A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script whe

6.1MEDIUM

CVE-2020-17480

< 4.9.7

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the

6.1MEDIUM

CVE-2019-1010091

< 4.9.10

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScr

6.1MEDIUM

CVE-2014-3845

<= 1.1

Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attacker

CVE-2014-3844

<= 1.1

The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to mod

CVE-2012-4230

all versions

The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) va

CVE-2012-3414

all versions

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, Tin

CVE-2013-2204

all versions

moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does no

CVE-2012-6112

all versions

classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.

CVE-2011-4825

<= 1.4.1

Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before