TinyMCE vulnerabilities

CVEs whose affected-version data names the TinyMCE package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

5 CVEsRSS

CVE-2024-38357Medium· 6.1

2y ago

TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

▾ Sunlittinymce · tinymceEPSS 0.53%via OSV

CVE-2024-38356Medium· 6.1

2y ago

TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

▾ Sunlittinymce · tinymceEPSS 0.53%via OSV

CVE-2024-21911Medium· 6.1

2y ago

TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability

TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's bro…

▾ Sunlittiny · tinymceEPSS 1.2%via NVD

CVE-2024-21908Medium· 6.1

2y ago

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's bro…

▾ Sunlittiny · tinymceEPSS 1.1%via NVD

CVE-2024-21910Medium· 6.1

4y ago

Cross-site scripting vulnerability in TinyMCE plugins

▾ Sunlittinymce · tinymceEPSS 0.96%via OSV