Skip to content
OpenAdvisories

Vendor

tinymce

14 known vulnerabilities.

Products

tinymce 14
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.7
    CVE-2026-47761 Public exploit

    TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

    TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impa…

    tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet