TinyMCE Color Picker
tinymce-colorpicker · plugin
Known security vulnerabilities for TinyMCE Color Picker. Find out in seconds which version runs on your site with WP Lens.
2 known vulnerabilities
latest May 22, 2014
Listed on wordpress.org · latest 1.3 · last updated Nov 28, 2017 · 1K+ installs
Not updated since Nov 28, 2017. A component left without updates for over two years should not be expected to patch new vulnerabilities.
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- Medium 6.8
Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijac
- Medium 5.0
The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).