npmPackage

tinymce

19 known vulnerabilities (5 high, 11 medium), with the versions each affects and the releases that fix them.

Latest release: 8.10.1 (Oct 28, 2026): no advisory affects it
Newest unaffected release: 8.10.1 (Oct 28, 2026), the latest release
Advisories: 19 · 5 high, 11 medium

Weekly downloads: 1.5M
Dependents: 77
Releases: 226 since 4.0.25 (May 6, 2014)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-116675
Affects 7.9.3 (8.0.0 is outside it); 8.5.1 to 8.9.2 (8.9.3 is outside it)
CVE-2026-47762
Affects 4.0.25 to 7.9.2 (7.9.3 is outside it); 8.0.0 to 8.5.0 (8.5.1 is outside it)
CVE-2026-47761
Affects 4.0.25 to 7.9.2 (7.9.3 is outside it); 8.0.0 to 8.5.0 (8.5.1 is outside it)
CVE-2026-47759
Affects 4.0.25 to 7.9.2 (7.9.3 is outside it); 8.0.0 to 8.5.0 (8.5.1 is outside it)
CVE-2026-47760
Affects 6.8.0 to 7.0.1 (7.1.0 is outside it)
CVE-2024-38357
Affects 4.0.25 to 6.8.3 (6.8.4 is outside it); 7.0.0 to 7.1.2 (7.2.0 is outside it)
CVE-2024-38356
Affects 4.0.25 to 6.8.3 (6.8.4 is outside it); 7.0.0 to 7.1.2 (7.2.0 is outside it)
CVE-2024-29881
Affects 4.0.25 to 6.8.6 (7.0.0 is outside it)
CVE-2024-29203
Affects 4.0.25 to 6.8.0 (6.8.1 is outside it)
CVE-2024-21911
Affects 4.0.25 to 5.5.1 (5.6.0 is outside it)
CVE-2024-21910
Affects 4.0.25 to 5.9.2 (5.10.0 is outside it)
CVE-2024-21908
Affects 4.0.25 to 5.8.2 (5.9.0 is outside it)

Show all 19 advisoriesShow fewer advisories

CVE-2023-48219
Affects 4.0.25 to 5.10.8 (5.10.9 is outside it); 6.0.0 to 6.7.2 (6.7.3 is outside it)
CVE-2023-45818
Affects 4.0.25 to 5.10.7 (5.10.8 is outside it); 6.0.0 to 6.7.0 (6.7.1 is outside it)
CVE-2023-45819
Affects 4.0.25 to 5.10.7 (5.10.8 is outside it); 6.0.0 to 6.7.0 (6.7.1 is outside it)
CVE-2022-23494
Affects 4.0.25 to 5.10.6 (5.10.7 is outside it); 6.0.0 to 6.3.0 (6.3.1 is outside it)
CVE-2020-12648
Affects 4.0.25 to 4.9.10 (4.9.11 is outside it); 5.0.0 to 5.4.0 (5.4.1 is outside it)
CVE-2020-17480
Affects 4.0.25 to 4.9.6 (4.9.7 is outside it); 5.0.0 to 5.1.3 (5.1.4 is outside it)
CVE-2019-1010091
Affects 4.0.25 to 4.9.9 (4.9.10 is outside it); 5.0.0 to 5.2.1 (5.2.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 19

CVE-2026-116675High 8.5
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
Affected: from 8.5.1, fixed in 8.9.3; from 7.9.3, fixed in 7.9.4.
Fixed in 8.0.0 (released Jul 23, 2025, 461 days before disclosure, the advisory names 7.9.4, which was never published) and 8.9.3 (released Oct 6, 2026, 21 days before disclosure).
The latest release, 8.10.1, is not affected.
18% of tinymce downloads last week were affected versions (314.6K).
CVE-2026-47762High 8.7
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
Affected: through 5.10.9; from 6.0.0, fixed in 7.9.3; from 8.0.0, fixed in 8.5.1.
Fixed in 7.9.3 (released May 20, 2026, 8 days before disclosure) and 8.5.1 (released May 20, 2026, 8 days before disclosure).
The latest release, 8.10.1, is not affected.
69% of tinymce downloads last week were affected versions (1.2M).
CVE-2026-47761High 8.7
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
Affected: through 5.10.9; from 6.0.0, fixed in 7.9.3; from 8.0.0, fixed in 8.5.1.
Fixed in 7.9.3 (released May 20, 2026, 8 days before disclosure) and 8.5.1 (released May 20, 2026, 8 days before disclosure).
The latest release, 8.10.1, is not affected.
69% of tinymce downloads last week were affected versions (1.2M).
CVE-2026-47759High 8.7
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
Affected: through 5.10.9; from 6.0.0, fixed in 7.9.3; from 8.0.0, fixed in 8.5.1.
Fixed in 7.9.3 (released May 20, 2026, 8 days before disclosure) and 8.5.1 (released May 20, 2026, 8 days before disclosure).
The latest release, 8.10.1, is not affected.
69% of tinymce downloads last week were affected versions (1.2M).
CVE-2026-47760High 8.7
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Affected: from 6.8.0, fixed in 7.1.0.
Fixed in 7.1.0 (released May 8, 2024, 750 days before disclosure).
The latest release, 8.10.1, is not affected.
30% of tinymce downloads last week were affected versions (514K).
CVE-2024-38357Medium 6.1
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Affected: fixed in 5.11.0; from 6.0.0, fixed in 6.8.4; from 7.0.0, fixed in 7.2.0.
Fixed in 6.8.4 (released Jun 19, 2024, the day of disclosure, the advisory names 5.11.0, which was never published) and 7.2.0 (released Jun 19, 2024, the day of disclosure).
The latest release, 8.10.1, is not affected.
28% of tinymce downloads last week were affected versions (493.7K).
CVE-2024-38356Medium 6.1
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Affected: fixed in 5.11.0; from 6.0.0, fixed in 6.8.4; from 7.0.0, fixed in 7.2.0.
Fixed in 6.8.4 (released Jun 19, 2024, the day of disclosure, the advisory names 5.11.0, which was never published) and 7.2.0 (released Jun 19, 2024, the day of disclosure).
The latest release, 8.10.1, is not affected.
28% of tinymce downloads last week were affected versions (493.7K).
CVE-2024-29881Medium 4.3
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
Affected: fixed in 7.0.0.
Fixed in 7.0.0 (released Mar 20, 2024, 6 days before disclosure).
The latest release, 8.10.1, is not affected.
48% of tinymce downloads last week were affected versions (835.9K).
CVE-2024-29203Medium 4.3
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
Affected: fixed in 6.8.1.
Fixed in 6.8.1 (released Nov 29, 2023, 118 days before disclosure).
The latest release, 8.10.1, is not affected.
19% of tinymce downloads last week were affected versions (330.1K).
CVE-2024-21911Medium 6.1
Cross-site scripting vulnerability in TinyMCE
Affected: fixed in 5.6.0.
Fixed in 5.6.0 (released Nov 18, 2020, 1141 days before disclosure).
The latest release, 8.10.1, is not affected.
4.6% of tinymce downloads last week were affected versions (79.7K).
CVE-2024-21910Medium 6.1
Cross-site scripting vulnerability in TinyMCE plugins
Affected: fixed in 5.10.0.
Fixed in 5.10.0 (released Oct 11, 2021, 814 days before disclosure).
The latest release, 8.10.1, is not affected.
5.3% of tinymce downloads last week were affected versions (91.8K).
CVE-2024-21908Medium 6.1
Cross-site scripting vulnerability in TinyMCE
Affected: fixed in 5.9.0.
Fixed in 5.9.0 (released Aug 26, 2021, 860 days before disclosure).
The latest release, 8.10.1, is not affected.
5.2% of tinymce downloads last week were affected versions (90.1K).
CVE-2023-48219Medium 6.1
Special characters in unescaped text nodes can trigger mXSS in TinyMCE
Affected: fixed in 5.10.9; from 6.0.0, fixed in 6.7.3.
Fixed in 5.10.9 (released Nov 15, 2023, the day of disclosure) and 6.7.3 (released Nov 15, 2023, the day of disclosure).
The latest release, 8.10.1, is not affected.
12% of tinymce downloads last week were affected versions (199.8K).
CVE-2023-45818Medium 6.1
Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin
Affected: from 6.0.0, fixed in 6.7.1; fixed in 5.10.8.
Fixed in 5.10.8 (released Oct 19, 2023, the day of disclosure) and 6.7.1 (released Oct 19, 2023, the day of disclosure).
The latest release, 8.10.1, is not affected.
11% of tinymce downloads last week were affected versions (194K).
CVE-2023-45819Medium 6.1
Cross-site Scripting vulnerability in TinyMCE notificationManager.open API
Affected: from 6.0.0, fixed in 6.7.1; fixed in 5.10.8.
Fixed in 5.10.8 (released Oct 19, 2023, the day of disclosure) and 6.7.1 (released Oct 19, 2023, the day of disclosure).
The latest release, 8.10.1, is not affected.
11% of tinymce downloads last week were affected versions (194K).

Show all 19 advisoriesShow fewer advisories

CVE-2022-23494Medium 5.4
Cross-site scripting vulnerability in TinyMCE alerts
Affected: from 6.0.0, fixed in 6.3.1; fixed in 5.10.7.
Fixed in 5.10.7 (released Dec 7, 2022, 1 day before disclosure) and 6.3.1 (released Dec 6, 2022, 2 days before disclosure).
The latest release, 8.10.1, is not affected.
7.6% of tinymce downloads last week were affected versions (131.6K).
CVE-2020-12648Unrated
A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when…
Affected: fixed in 4.9.11; from 5.0.0, fixed in 5.4.1.
Fixed in 4.9.11 (released Jul 13, 2020, 32 days before disclosure) and 5.4.1 (released Jul 8, 2020, 37 days before disclosure).
The latest release, 8.10.1, is not affected.
2.7% of tinymce downloads last week were affected versions (46.2K).
CVE-2020-17480Unrated
TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the…
Affected: fixed in 4.9.7; from 5.0.0, fixed in 5.1.4.
Fixed in 4.9.7 (released Dec 19, 2019, 235 days before disclosure) and 5.1.4 (released Dec 11, 2019, 243 days before disclosure).
The latest release, 8.10.1, is not affected.
1.7% of tinymce downloads last week were affected versions (29.4K).
CVE-2019-1010091Unrated
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation.
Affected: fixed in 4.9.10; from 5.0.0, fixed in 5.2.2.
Fixed in 4.9.10 (released Apr 23, 2020, 281 days after disclosure) and 5.2.2 (released Apr 23, 2020, 281 days after disclosure).
The latest release, 8.10.1, is not affected.
2% of tinymce downloads last week were affected versions (35.4K).