TinyMCE vulnerabilitiesTinyMCE: known vulnerabilities and safe versions
npm: tinymce
TinyMCE has 27 known vulnerability records: 18 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 9 only in Retire.js (CDN builds and advisories without a CVE).
By branch: 8.x is safe from 8.5.1; 7.x is safe from 7.9.3; 6.x has no fixed release in the records; 5.x has no fixed release in the records.
Vulnerabilities and safe version by branch
Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.
| Branch | Support | Latest on branch | Records | Safe version |
|---|---|---|---|---|
| 8.x | — | — | 3medium | 8.5.1 |
| 7.x | — | — | 6medium | 7.9.3 |
| 6.x | — | — | 12medium | No fix |
| 5.x | — | — | 22medium | No fix |
| 4.x | — | — | 25medium | No fix |
| 1.x | — | — | 26high | No fix |
Support dates appear only for libraries that endoflife.date tracks.
Records
Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.
CVE-2026-477622026-05-28
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
Affected versions: <= 5.10.9 · >= 6.0.0, < 7.9.3 · >= 8.0.0, < 8.5.1 · < 5.10.10
medium 5.4
Fixed in: 5.10.10, 7.9.3, 8.5.1
CVE-2026-47761exploit code exists2026-05-28
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
Affected versions: <= 5.10.9 · >= 6.0.0, < 7.9.3 · >= 8.0.0, < 8.5.1 · < 5.10.10
medium 5.4
Fixed in: 5.10.10, 7.9.3, 8.5.1
CVE-2026-477602026-05-28
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Affected versions: >= 6.8.0, < 7.1.0
medium 5.4
Fixed in: 7.1.0
CVE-2026-477592026-05-28
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
Affected versions: <= 5.10.9 · >= 6.0.0, < 7.9.3 · >= 8.0.0, < 8.5.1 · < 5.10.10
medium 5.4
Fixed in: 5.10.10, 7.9.3, 8.5.1
CVE-2024-383572024-06-19
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Affected versions: < 5.11.0 · >= 6.0.0, < 6.8.4 · >= 7.0.0, < 7.2.0
medium 6.1
Fixed in: 5.11.0, 6.8.4, 7.2.0
CVE-2024-383562024-06-19
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Affected versions: < 5.11.0 · >= 6.0.0, < 6.8.4 · >= 7.0.0, < 7.2.0
medium 6.1
Fixed in: 5.11.0, 6.8.4, 7.2.0
CVE-2024-298812024-03-26
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
Affected versions: < 7.0.0
medium 6.1
Fixed in: 7.0.0
CVE-2024-292032024-03-26
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
Affected versions: < 6.8.1
medium 6.1
Fixed in: 6.8.1
medium 6.1
Fixed in: 5.6.0
EPSS 1.1%
CVE-2024-219102024-01-03
Cross-site scripting vulnerability in TinyMCE plugins
Affected versions: < 5.10.0
medium 6.1
Fixed in: 5.10.0
medium 6.1
Fixed in: 5.9.0
EPSS 1%
CVE-2023-482192023-11-15
Special characters in unescaped text nodes can trigger mXSS in TinyMCE
Affected versions: < 5.10.9 · >= 6.0.0, < 6.7.3
medium 6.1
Fixed in: 5.10.9, 6.7.3
CVE-2023-458192023-10-19
Cross-site Scripting vulnerability in TinyMCE notificationManager.open API
Affected versions: >= 6.0.0, < 6.7.1 · < 5.10.8
medium 6.1
Fixed in: 5.10.8, 6.7.1
CVE-2023-458182023-10-19
Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin
Affected versions: >= 6.0.0, < 6.7.1 · < 5.10.8
medium 6.1
Fixed in: 5.10.8, 6.7.1
CVE-2022-234942022-12-08
Cross-site scripting vulnerability in TinyMCE alerts
Affected versions: >= 6.0.0, < 6.3.1 · < 5.10.7
medium 6.1
Fixed in: 5.10.7, 6.3.1
EPSS 1%
CVE-2020-126482020-08-14
A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configur
Affected versions: < 4.9.11 · >= 5.0.0, < 5.4.1
medium 6.1
Fixed in: 4.9.11, 5.4.1
EPSS 1.8%
CVE-2020-174802020-08-10
TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard
Affected versions: < 4.9.7 · >= 5.0.0, < 5.1.4
medium 6.1
Fixed in: 4.9.7, 5.1.4
EPSS 1.2%
CVE-2019-10100912019-07-17
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation.
Affected versions: < 4.9.10 · >= 5.0.0, < 5.2.2
medium 6.1
Fixed in: 4.9.10, 5.2.2
EPSS 1.9%
CVE-2011-4825weaponized2011-12-14
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, php
Affected versions: < 1.4.2
high 7.5
Fixed in: 1.4.2
EPSS 39.1%
no CVE
content in an iframe element parsing as DOM elements instead of text content.
Affected versions: < 5.4.0
low
Fixed in: 5.4.0
no CVE
media embed content not processing safely in some cases.
Affected versions: < 5.2.2
low
Fixed in: 5.2.2
no CVE
CDATA parsing and sanitization has been improved to address a cross-site scripting (XSS) vulnerability.
Affected versions: < 5.1.6
medium
Fixed in: 5.1.6
no CVE
FIXED so links with xlink:href attributes are filtered correctly to prevent XSS.
Affected versions: < 4.7.12
medium
Fixed in: 4.7.12
no CVE
xss issues with media plugin not properly filtering out some script attributes.
Affected versions: < 4.2.4
medium
Fixed in: 4.2.4
no CVE
FIXED so script elements gets removed by default to prevent possible XSS issues in default config implementations
Affected versions: < 4.2.0
medium
Fixed in: 4.2.0
Regex denial of service vulnerability in codesample plugin
Affected versions: < 5.6.0
low
Fixed in: 5.6.0
medium
Fixed in: 5.7.1
Sources and method
Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.
This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.
Data as of October 20, 2026.