945 matches found
TinyMCE shortcode Addon <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute
Description The TinyMCE shortcode Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...
EUVD-2026-32922
TinyMCE Cross-Site Scripting XSS vulnerability using media plugin data-mce-object injection...
17fe-ui23 (>=0.0.0, <=0.0.24), @2kog/pkg-editor (>=0.0.1, <=0.1.3) +744 more potentially affected by CVE-2026-47761 via tinymce (>=6.0.0, <=7.5.1)
tinymce NPM version =6.0.0, =0.0.0, =0.0.1, =12.1.0, =4.1.0, =1.0.0-beta.1, =4.1.2-rc, =1.0.0, =0.1.0, =0.1.23 and more Source cves: CVE-2026-47761 Source advisory: OSV:GHSA-VG35-5WQ7-3X7W...
GHSA-VG35-5WQ7-3X7W TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce- attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. Patches This vulnerability has been patched in TinyMCE 8.5.1, TinyMCE...
bsign-ui (>=0.0.3, <=0.0.5), gc-nimbus-ui (>=3.0.0, <=3.0.12) potentially affected by CVE-2026-47761 via tinymce (>=8.0.2, <=8.2.2)
tinymce NPM version =8.0.2, =0.0.3, =3.0.0, =3.0.12 Source cves: CVE-2026-47761 Source advisory: OSV:GHSA-VG35-5WQ7-3X7W...
3h1-ui (>=2.14.41, <=3.0.0-next.266), @abt-desk/apm (>=0.0.1, <=0.33.12) +1871 more potentially affected by CVE-2026-47761 via tinymce (>=5.0.6, <=5.10.9)
tinymce NPM version =5.0.6, =2.14.41, =0.0.1, =0.1.0, =0.1.2, =0.3.7, =0.1.7, =0.1.0, =0.0.1, =0.2.0-0, =1.0.18-beta.8, =1.0.0, =1.2.3-beta.1, =0.1.1, =0.1.11 and more Source cves: CVE-2026-47761 Source advisory: OSV:GHSA-VG35-5WQ7-3X7W...
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce- attributes, which are executed when content is rendered. Impacts users of TinyMCE with the media plugin enabled. Patches This vulnerability has been patched in TinyMCE 8.5.1, TinyMCE...
EUVD-2026-32923
TinyMCE Cross-Site Scripting XSS vulnerability through mce:protected comments...
GHSA-V98H-VMPC-FPQV TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
Impact Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. Patches Patched by validating decoded mce:protected content against configured protect...
3h1-ui (>=2.14.41, <=3.0.0-next.266), @abt-desk/apm (>=0.0.1, <=0.33.12) +1871 more potentially affected by CVE-2026-47762 via tinymce (>=5.0.6, <=5.10.9)
tinymce NPM version =5.0.6, =2.14.41, =0.0.1, =0.1.0, =0.1.2, =0.3.7, =0.1.7, =0.1.0, =0.0.1, =0.2.0-0, =1.0.18-beta.8, =1.0.0, =1.2.3-beta.1, =0.1.1, =0.1.11 and more Source cves: CVE-2026-47762 Source advisory: OSV:GHSA-V98H-VMPC-FPQV...
17fe-ui23 (>=0.0.0, <=0.0.24), @2kog/pkg-editor (>=0.0.1, <=0.1.3) +744 more potentially affected by CVE-2026-47762 via tinymce (>=6.0.0, <=7.5.1)
tinymce NPM version =6.0.0, =0.0.0, =0.0.1, =12.1.0, =4.1.0, =1.0.0-beta.1, =4.1.2-rc, =1.0.0, =0.1.0, =0.1.23 and more Source cves: CVE-2026-47762 Source advisory: OSV:GHSA-V98H-VMPC-FPQV...
bsign-ui (>=0.0.3, <=0.0.5), gc-nimbus-ui (>=3.0.0, <=3.0.12) potentially affected by CVE-2026-47762 via tinymce (>=8.0.2, <=8.2.2)
tinymce NPM version =8.0.2, =0.0.3, =3.0.0, =3.0.12 Source cves: CVE-2026-47762 Source advisory: OSV:GHSA-V98H-VMPC-FPQV...
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
Impact Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize the protect option. Patches Patched by validating decoded mce:protected content against configured protect...
EUVD-2026-32921
TinyMCE Cross-Site Scripting XSS vulnerability using through data-mce- prefixed src, href, style attributes...
bsign-ui (>=0.0.3, <=0.0.5), gc-nimbus-ui (>=3.0.0, <=3.0.12) potentially affected by CVE-2026-47759 via tinymce (>=8.0.2, <=8.2.2)
tinymce NPM version =8.0.2, =0.0.3, =3.0.0, =3.0.12 Source cves: CVE-2026-47759 Source advisory: OSV:GHSA-Q742-QVGC-GC2F...
GHSA-Q742-QVGC-GC2F TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
Impact Stored XSS vulnerability via unsanitized data-mce- attributes data-mce-href, data-mce-src, data-mce-style. Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. Patches Patched by stripping unsafe data-mce- attributes during...
3h1-ui (>=2.14.41, <=3.0.0-next.266), @abt-desk/apm (>=0.0.1, <=0.33.12) +1871 more potentially affected by CVE-2026-47759 via tinymce (>=5.0.6, <=5.10.9)
tinymce NPM version =5.0.6, =2.14.41, =0.0.1, =0.1.0, =0.1.2, =0.3.7, =0.1.7, =0.1.0, =0.0.1, =0.2.0-0, =1.0.18-beta.8, =1.0.0, =1.2.3-beta.1, =0.1.1, =0.1.11 and more Source cves: CVE-2026-47759 Source advisory: OSV:GHSA-Q742-QVGC-GC2F...
17fe-ui23 (>=0.0.0, <=0.0.24), @2kog/pkg-editor (>=0.0.1, <=0.1.3) +744 more potentially affected by CVE-2026-47759 via tinymce (>=6.0.0, <=7.5.1)
tinymce NPM version =6.0.0, =0.0.0, =0.0.1, =12.1.0, =4.1.0, =1.0.0-beta.1, =4.1.2-rc, =1.0.0, =0.1.0, =0.1.23 and more Source cves: CVE-2026-47759 Source advisory: OSV:GHSA-Q742-QVGC-GC2F...
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
Impact Stored XSS vulnerability via unsanitized data-mce- attributes data-mce-href, data-mce-src, data-mce-style. Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation. Patches Patched by stripping unsafe data-mce- attributes during...