Dropbox: Forum posts and private messages are poorly sanitized, allowing execution of arbitrary JavaScript

The reporter informed us of both stored XSS vulnerabilities as well as unsafe css attributes that were allowed in forum posts due to TinyMCE editor. An upgrade to lithium's forum platform appears to have mitigated these vulnerabilities...

FreeBSD : wordpress -- multiple issues (a48d4478-e23f-4085-8ae4-6b3a7b6f016b)

wordpress developers report : Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. Before...

Cross-site Scripting (XSS)

WordPress is vulnerable to cross-site scripting XSS attacks. The library does not escape tags in shortcode previews in the TinyMCE editor, allowing a malicious user to inject and execute arbitrary web script...

WordPress TinyMCE Virtual Editor Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers to set up a personal blog site.TinyMCE visual editor is one of the virtual editor. A cross-site scripting vulnerability exists in the TinyMCE...

CVE-2017-14726

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor...

CVE-2017-14726

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor...

DEBIAN-CVE-2017-14726

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor...

Cross site scripting

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor...

CVE-2017-14726

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor...

UBUNTU-CVE-2017-14726

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor...

CVE-2017-14726

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor...

CVE-2017-14726

CVE-2017-14726 affects WordPress up to version 4.8.1; a cross-site scripting (XSS) vulnerability exists through shortcodes in the TinyMCE visual editor. Exploitation could occur in contexts where crafted shortcodes are processed by the editor, enabling an attacker to inject arbitrary HTML/JavaScr...

CVE-2017-14726

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

Shopify: Tinymce 2.4.0

Hello, The following url https://app.shopify.com//services/mobileapp/rte Loads https://cdn.shopify.com/s/assets/mobileapp/rte-bundle-f044a6c638b6c0500848c772dd5c86bf0eb2b27516c0860c6d3ddafde42231e2.js which is a minified tinymce 2.4.0. This version of tinymce has known vulnerabilities but in orde...

Pluck CMS TinyMCE Cross-Site Scripting Vulnerability

Pluck CMS is a content management system CMS written in php.TinyMCE is one of the browser-based visual HTML editors. A cross-site scripting vulnerability exists in TinyMCE in Pluck CMS version 4.7.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Cross site scripting

Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...

CVE-2014-8707

Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...

CVE-2014-8707

Summary: CVE-2014-8707 is a cross-site scripting (XSS) vulnerability in TinyMCE within Pluck CMS version 4.7.2. The flaw allows remote authenticated users to inject arbitrary script/HTML via the TinyMCE “edit HTML source” option. The connected CNVD entry for Pluck CMS confirms a TinyMCE XSS issue...

Fedora Update for tinymce FEDORA-2016-8d8d7d6d47

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 25 Update: tinymce-4.5.1-1.fc25

TinyMCE is a platform independent web based Javascript HTML WYSIWYG editor control released as by Moxiecode Systems AB. It has the ability to convert HTML TEXTAREA fields or other HTML elements to editor instances. TinyMCE is very easy to integrate into other CMS systems...