GHSA-27GM-GHR9-4V95 Cross-site scripting vulnerability in TinyMCE

Impact A cross-site scripting XSS vulnerability was discovered in: the core parser, paste and visualchars plugins. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are...

3h1-ui (>=2.14.41 <=3.0.0-next.258), @abt-desk/apm (>=0.0.1 <=0.33.12) +937 more potentially affected by CVE-2020-17480 via tinymce (>=5.0.11 <=5.1.0)

tinymce NPM version =5.0.11, =2.14.41, =0.0.1, =0.1.0, =0.1.2, =0.3.7, =0.1.17, =0.1.0, =0.0.1, =0.2.0-0, =1.0.18-beta.8, =1.0.0, =1.2.3-beta.1, =0.1.1, =1.0.0, =8.7.0 and more Source cves: CVE-2020-17480 Source advisory: OSV:GHSA-27GM-GHR9-4V95...

@angular-materials/ngx-admin (>=1.0.0 <=1.0.1), @aurocraft/builder (>=1.0.0 <=3.3.3) +292 more potentially affected by CVE-2020-17480 via tinymce (>=4.5.1 <=4.9.5)

tinymce NPM version =4.5.1, =1.0.0, =1.0.0, =1.0.0-alpha.39-baliz, =4.3.0, =0.5.0, =0.1.0, =0.0.4, =0.1.1, =0.0.13, =1.3.0, =1.0.0, =2.0.0-beta.1, =1.1.1, =1.1.3 and more Source cves: CVE-2020-17480 Source advisory: OSV:GHSA-27GM-GHR9-4V95...

Cross-Site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the HTML comments and CDATA information...

8x8: (Critical) Remote Code Execution Through Old TinyMCE upload bypass

A third party marketing site utilized an outdated version of TinyMCE that was vulnerable to CVE-2011-4906...

CVE-2014-4548

CVE-2014-4548 : The Ruven Toolkit WordPress plugin (

CVE-2013-1426

Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...

CVE-2013-1426

Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...

Cross site scripting

Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...

CVE-2013-1426

Affected software: Mahara. Vulnerable component: TinyMCE editor used in Mahara pages. Root cause: Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary script/HTML via the TinyMCE editor. Impact: potential remote code execution in the...

CVE-2013-1426

Cross-site Scripting XSS in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor...

CVE-2016-10957

The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter...

CVE-2016-10957

The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter...

CVE-2019-7866

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

CVE-2019-7866

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

Cross site scripting

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

CVE-2019-7866

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor...

CVE-2019-7866

Magento 2.x suffers a stored XSS in the admin panel, affecting 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. An authenticated user with access to edit product information via the TinyMCE editor can exploit it. Root cause: lack of input sanitization in admin product editing flow. Impa...

tinymce Media element component cross-site scripting vulnerability

tinymce is a JavaScript library for rich text editing . A cross-site scripting vulnerability exists in the Media element component in tinymce version 4.7.11, 4.7.12. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the...

Cross-Site Scripting (XSS)

tinymce is vulnerable to Cross-Site Scripting. The library does not properly sanitise the input to the media element, allowing users to paste malicious content to media element's embed tab to execute arbitrary Javascript code...