CVE-2024-29881

TinyMCE is affected by an XSS vulnerability (CVE-2024-29881) in its handling of external SVG content loaded via object/embed during content loading/insertion. The root cause is improper validation of user-supplied input via SVGs, allowing a payload to execute in the context of the hosting site. T...

CVE-2024-21908

CVE-2024-21908 (TinyMCE) : Affected software versions are TinyMCE before 5.9.0. The issue is a stored cross-site scripting vulnerability where an unauthenticated, remote attacker can insert crafted HTML into the editor, leading to arbitrary JavaScript execution in another user’s browser. Root cau...

CVE-2024-21910

CVE-2024-21910 affects TinyMCE plugins with versions before 5.10.0. The issue is a cross-site scripting vulnerability: a remote, unauthenticated attacker can craft image or link URLs that cause execution of arbitrary JavaScript in an editing user’s browser. The description in connected sources co...

CVE-2024-21911

TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated, remote attacker could insert crafted HTML into the editor, leading to arbitrary JavaScript execution in another user’s browser. The CVE entry lists a base score of 6.1 (Medium). Remediat...

CVE-2024-29203

TinyMCE contains a cross-site scripting (XSS) vulnerability in its content insertion code that can allow iframe elements to execute malicious scripts. The issue is mitigated by upgrading to TinyMCE v6.8.1 or newer; multiple advisories also note that patches and later versions (e.g., 7.0.0+) addre...