# tinymce (npm) vulnerabilities 19 known vulnerabilities (5 high, 11 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 8.10.1 (Oct 28, 2026): no advisory affects it - Newest unaffected release: 8.10.1 (Oct 28, 2026), the latest release - Weekly downloads: 1.5M - Dependents: 77 - Releases: 226 since 4.0.25 (May 6, 2014) - Registry: https://www.npmjs.com/package/tinymce - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-116675: 7.9.3 (8.0.0 is outside it); 8.5.1 to 8.9.2 (8.9.3 is outside it) - CVE-2026-47762: 4.0.25 to 7.9.2 (7.9.3 is outside it); 8.0.0 to 8.5.0 (8.5.1 is outside it) - CVE-2026-47761: 4.0.25 to 7.9.2 (7.9.3 is outside it); 8.0.0 to 8.5.0 (8.5.1 is outside it) - CVE-2026-47759: 4.0.25 to 7.9.2 (7.9.3 is outside it); 8.0.0 to 8.5.0 (8.5.1 is outside it) - CVE-2026-47760: 6.8.0 to 7.0.1 (7.1.0 is outside it) - CVE-2024-38357: 4.0.25 to 6.8.3 (6.8.4 is outside it); 7.0.0 to 7.1.2 (7.2.0 is outside it) - CVE-2024-38356: 4.0.25 to 6.8.3 (6.8.4 is outside it); 7.0.0 to 7.1.2 (7.2.0 is outside it) - CVE-2024-29881: 4.0.25 to 6.8.6 (7.0.0 is outside it) - CVE-2024-29203: 4.0.25 to 6.8.0 (6.8.1 is outside it) - CVE-2024-21911: 4.0.25 to 5.5.1 (5.6.0 is outside it) - CVE-2024-21910: 4.0.25 to 5.9.2 (5.10.0 is outside it) - CVE-2024-21908: 4.0.25 to 5.8.2 (5.9.0 is outside it) - CVE-2023-48219: 4.0.25 to 5.10.8 (5.10.9 is outside it); 6.0.0 to 6.7.2 (6.7.3 is outside it) - CVE-2023-45818: 4.0.25 to 5.10.7 (5.10.8 is outside it); 6.0.0 to 6.7.0 (6.7.1 is outside it) - CVE-2023-45819: 4.0.25 to 5.10.7 (5.10.8 is outside it); 6.0.0 to 6.7.0 (6.7.1 is outside it) - CVE-2022-23494: 4.0.25 to 5.10.6 (5.10.7 is outside it); 6.0.0 to 6.3.0 (6.3.1 is outside it) - CVE-2020-12648: 4.0.25 to 4.9.10 (4.9.11 is outside it); 5.0.0 to 5.4.0 (5.4.1 is outside it) - CVE-2020-17480: 4.0.25 to 4.9.6 (4.9.7 is outside it); 5.0.0 to 5.1.3 (5.1.4 is outside it) - CVE-2019-1010091: 4.0.25 to 4.9.9 (4.9.10 is outside it); 5.0.0 to 5.2.1 (5.2.2 is outside it) ## Advisories (19) ### [CVE-2026-116675](https://cve.now/CVE-2026-116675): TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin \`data-mce-object\` serialization - Severity: High 8.5 - Published: Oct 27, 2026 - Affected: from 8.5.1, fixed in 8.9.3; from 7.9.3, fixed in 7.9.4. - Fixed in 8.0.0 (released Jul 23, 2025, 461 days before disclosure, the advisory names 7.9.4, which was never published) and 8.9.3 (released Oct 6, 2026, 21 days before disclosure). - The latest release, 8.10.1, is not affected. - 18% of tinymce downloads last week were affected versions (314.6K). ### [CVE-2026-47762](https://cve.now/CVE-2026-47762): TinyMCE Cross-Site Scripting (XSS) vulnerability through \`mce:protected\` comments - Severity: High 8.7 - Published: May 28, 2026 - Affected: through 5.10.9; from 6.0.0, fixed in 7.9.3; from 8.0.0, fixed in 8.5.1. - Fixed in 7.9.3 (released May 20, 2026, 8 days before disclosure) and 8.5.1 (released May 20, 2026, 8 days before disclosure). - The latest release, 8.10.1, is not affected. - 69% of tinymce downloads last week were affected versions (1.2M). ### [CVE-2026-47761](https://cve.now/CVE-2026-47761): TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin \`data-mce-object\` injection - Severity: High 8.7 - Published: May 28, 2026 - Affected: through 5.10.9; from 6.0.0, fixed in 7.9.3; from 8.0.0, fixed in 8.5.1. - Fixed in 7.9.3 (released May 20, 2026, 8 days before disclosure) and 8.5.1 (released May 20, 2026, 8 days before disclosure). - The latest release, 8.10.1, is not affected. - 69% of tinymce downloads last week were affected versions (1.2M). ### [CVE-2026-47759](https://cve.now/CVE-2026-47759): TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - Severity: High 8.7 - Published: May 28, 2026 - Affected: through 5.10.9; from 6.0.0, fixed in 7.9.3; from 8.0.0, fixed in 8.5.1. - Fixed in 7.9.3 (released May 20, 2026, 8 days before disclosure) and 8.5.1 (released May 20, 2026, 8 days before disclosure). - The latest release, 8.10.1, is not affected. - 69% of tinymce downloads last week were affected versions (1.2M). ### [CVE-2026-47760](https://cve.now/CVE-2026-47760): TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - Severity: High 8.7 - Published: May 28, 2026 - Affected: from 6.8.0, fixed in 7.1.0. - Fixed in 7.1.0 (released May 8, 2024, 750 days before disclosure). - The latest release, 8.10.1, is not affected. - 30% of tinymce downloads last week were affected versions (514K). ### [CVE-2024-38357](https://cve.now/CVE-2024-38357): TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements - Severity: Medium 6.1 - Published: Jun 19, 2024 - Affected: fixed in 5.11.0; from 6.0.0, fixed in 6.8.4; from 7.0.0, fixed in 7.2.0. - Fixed in 6.8.4 (released Jun 19, 2024, the day of disclosure, the advisory names 5.11.0, which was never published) and 7.2.0 (released Jun 19, 2024, the day of disclosure). - The latest release, 8.10.1, is not affected. - 28% of tinymce downloads last week were affected versions (493.7K). ### [CVE-2024-38356](https://cve.now/CVE-2024-38356): TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable\_regexp option - Severity: Medium 6.1 - Published: Jun 19, 2024 - Affected: fixed in 5.11.0; from 6.0.0, fixed in 6.8.4; from 7.0.0, fixed in 7.2.0. - Fixed in 6.8.4 (released Jun 19, 2024, the day of disclosure, the advisory names 5.11.0, which was never published) and 7.2.0 (released Jun 19, 2024, the day of disclosure). - The latest release, 8.10.1, is not affected. - 28% of tinymce downloads last week were affected versions (493.7K). ### [CVE-2024-29881](https://cve.now/CVE-2024-29881): TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - Severity: Medium 4.3 - Published: Mar 26, 2024 - Affected: fixed in 7.0.0. - Fixed in 7.0.0 (released Mar 20, 2024, 6 days before disclosure). - The latest release, 8.10.1, is not affected. - 48% of tinymce downloads last week were affected versions (835.9K). ### [CVE-2024-29203](https://cve.now/CVE-2024-29203): TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes - Severity: Medium 4.3 - Published: Mar 26, 2024 - Affected: fixed in 6.8.1. - Fixed in 6.8.1 (released Nov 29, 2023, 118 days before disclosure). - The latest release, 8.10.1, is not affected. - 19% of tinymce downloads last week were affected versions (330.1K). ### [CVE-2024-21911](https://cve.now/CVE-2024-21911): Cross-site scripting vulnerability in TinyMCE - Severity: Medium 6.1 - Published: Jan 3, 2024 - Affected: fixed in 5.6.0. - Fixed in 5.6.0 (released Nov 18, 2020, 1141 days before disclosure). - The latest release, 8.10.1, is not affected. - 4.6% of tinymce downloads last week were affected versions (79.7K). ### [CVE-2024-21910](https://cve.now/CVE-2024-21910): Cross-site scripting vulnerability in TinyMCE plugins - Severity: Medium 6.1 - Published: Jan 3, 2024 - Affected: fixed in 5.10.0. - Fixed in 5.10.0 (released Oct 11, 2021, 814 days before disclosure). - The latest release, 8.10.1, is not affected. - 5.3% of tinymce downloads last week were affected versions (91.8K). ### [CVE-2024-21908](https://cve.now/CVE-2024-21908): Cross-site scripting vulnerability in TinyMCE - Severity: Medium 6.1 - Published: Jan 3, 2024 - Affected: fixed in 5.9.0. - Fixed in 5.9.0 (released Aug 26, 2021, 860 days before disclosure). - The latest release, 8.10.1, is not affected. - 5.2% of tinymce downloads last week were affected versions (90.1K). ### [CVE-2023-48219](https://cve.now/CVE-2023-48219): Special characters in unescaped text nodes can trigger mXSS in TinyMCE - Severity: Medium 6.1 - Published: Nov 15, 2023 - Affected: fixed in 5.10.9; from 6.0.0, fixed in 6.7.3. - Fixed in 5.10.9 (released Nov 15, 2023, the day of disclosure) and 6.7.3 (released Nov 15, 2023, the day of disclosure). - The latest release, 8.10.1, is not affected. - 12% of tinymce downloads last week were affected versions (199.8K). ### [CVE-2023-45818](https://cve.now/CVE-2023-45818): Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin - Severity: Medium 6.1 - Published: Oct 19, 2023 - Affected: from 6.0.0, fixed in 6.7.1; fixed in 5.10.8. - Fixed in 5.10.8 (released Oct 19, 2023, the day of disclosure) and 6.7.1 (released Oct 19, 2023, the day of disclosure). - The latest release, 8.10.1, is not affected. - 11% of tinymce downloads last week were affected versions (194K). ### [CVE-2023-45819](https://cve.now/CVE-2023-45819): Cross-site Scripting vulnerability in TinyMCE notificationManager.open API - Severity: Medium 6.1 - Published: Oct 19, 2023 - Affected: from 6.0.0, fixed in 6.7.1; fixed in 5.10.8. - Fixed in 5.10.8 (released Oct 19, 2023, the day of disclosure) and 6.7.1 (released Oct 19, 2023, the day of disclosure). - The latest release, 8.10.1, is not affected. - 11% of tinymce downloads last week were affected versions (194K). ### [CVE-2022-23494](https://cve.now/CVE-2022-23494): Cross-site scripting vulnerability in TinyMCE alerts - Severity: Medium 5.4 - Published: Dec 8, 2022 - Affected: from 6.0.0, fixed in 6.3.1; fixed in 5.10.7. - Fixed in 5.10.7 (released Dec 7, 2022, 1 day before disclosure) and 6.3.1 (released Dec 6, 2022, 2 days before disclosure). - The latest release, 8.10.1, is not affected. - 7.6% of tinymce downloads last week were affected versions (131.6K). ### [CVE-2020-12648](https://cve.now/CVE-2020-12648): A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when… - Severity: Unrated - Published: Aug 14, 2020 - Affected: fixed in 4.9.11; from 5.0.0, fixed in 5.4.1. - Fixed in 4.9.11 (released Jul 13, 2020, 32 days before disclosure) and 5.4.1 (released Jul 8, 2020, 37 days before disclosure). - The latest release, 8.10.1, is not affected. - 2.7% of tinymce downloads last week were affected versions (46.2K). ### [CVE-2020-17480](https://cve.now/CVE-2020-17480): TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the… - Severity: Unrated - Published: Aug 10, 2020 - Affected: fixed in 4.9.7; from 5.0.0, fixed in 5.1.4. - Fixed in 4.9.7 (released Dec 19, 2019, 235 days before disclosure) and 5.1.4 (released Dec 11, 2019, 243 days before disclosure). - The latest release, 8.10.1, is not affected. - 1.7% of tinymce downloads last week were affected versions (29.4K). ### [CVE-2019-1010091](https://cve.now/CVE-2019-1010091): tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. - Severity: Unrated - Published: Jul 17, 2019 - Affected: fixed in 4.9.10; from 5.0.0, fixed in 5.2.2. - Fixed in 4.9.10 (released Apr 23, 2020, 281 days after disclosure) and 5.2.2 (released Apr 23, 2020, 281 days after disclosure). - The latest release, 8.10.1, is not affected. - 2% of tinymce downloads last week were affected versions (35.4K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/tinymce Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.