Skip to main content
cve.nowby Sazabi
← NuGet
NuGetPackage

TinyMCE

16 known vulnerabilities (5 high, 11 medium), with the versions each affects and the releases that fix them.

Latest release
8.10.1 (Oct 28, 2026): no advisory affects it
Newest unaffected release
8.10.1 (Oct 28, 2026), the latest release
Advisories
16 · 5 high, 11 medium
Releases
258 since 3.4.3.2 (Aug 3, 2011)
Registry
NuGet
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-116675
    Affects 7.9.3 (8.0.0 is outside it); 8.5.1 to 8.9.2 (8.9.3 is outside it)
  • CVE-2026-47762
    Affects 3.4.3.2 to 7.9.2 (7.9.3 is outside it); 8.0.0 to 8.5.0 (8.5.1 is outside it)
  • CVE-2026-47761
    Affects 3.4.3.2 to 7.9.2 (7.9.3 is outside it); 8.0.0 to 8.5.0 (8.5.1 is outside it)
  • CVE-2026-47759
    Affects 3.4.3.2 to 7.9.2 (7.9.3 is outside it); 8.0.0 to 8.5.0 (8.5.1 is outside it)
  • CVE-2026-47760
    Affects 6.8.0 to 7.0.1 (7.1.0 is outside it)
  • CVE-2024-38357
    Affects 3.4.3.2 to 6.8.3 (6.8.4 is outside it); 7.0.0 to 7.1.2 (7.2.0 is outside it)
  • CVE-2024-38356
    Affects 3.4.3.2 to 6.8.3 (6.8.4 is outside it); 7.0.0 to 7.1.2 (7.2.0 is outside it)
  • CVE-2024-29881
    Affects 3.4.3.2 to 6.8.6 (7.0.0 is outside it)
  • CVE-2024-29203
    Affects 3.4.3.2 to 6.8.0 (6.8.1 is outside it)
  • CVE-2024-21911
    Affects 3.4.3.2 to 5.5.1 (5.6.0 is outside it)
  • CVE-2024-21910
    Affects 3.4.3.2 to 5.9.2 (5.10.0 is outside it)
  • CVE-2024-21908
    Affects 3.4.3.2 to 5.8.2 (5.9.0 is outside it)
Show all 16 advisoriesShow fewer advisories
  • CVE-2023-48219
    Affects 3.4.3.2 to 5.10.8 (5.10.9 is outside it); 6.0.0 to 6.7.2 (6.7.3 is outside it)
  • CVE-2023-45818
    Affects 3.4.3.2 to 5.10.7 (5.10.8 is outside it); 6.0.0 to 6.7.0 (6.7.1 is outside it)
  • CVE-2023-45819
    Affects 3.4.3.2 to 5.10.7 (5.10.8 is outside it); 6.0.0 to 6.7.0 (6.7.1 is outside it)
  • CVE-2022-23494
    Affects 3.4.3.2 to 5.10.6 (5.10.7 is outside it); 6.0.0 to 6.3.0 (6.3.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 16

  • TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

    Affected: from 8.5.1, fixed in 8.9.3; from 7.9.3, fixed in 7.9.4.

    Fixed in 8.0.0 (released Jul 23, 2025, 461 days before disclosure, the advisory names 7.9.4, which was never published) and 8.9.3 (released Oct 6, 2026, 21 days before disclosure).

    The latest release, 8.10.1, is not affected.

  • TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

    Affected: through 5.10.9; from 6.0.0, fixed in 7.9.3; from 8.0.0, fixed in 8.5.1.

    Fixed in 7.9.3 (released May 19, 2026, 9 days before disclosure) and 8.5.1 (released May 19, 2026, 9 days before disclosure).

    The latest release, 8.10.1, is not affected.

  • TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

    Affected: through 5.10.9; from 6.0.0, fixed in 7.9.3; from 8.0.0, fixed in 8.5.1.

    Fixed in 7.9.3 (released May 19, 2026, 9 days before disclosure) and 8.5.1 (released May 19, 2026, 9 days before disclosure).

    The latest release, 8.10.1, is not affected.

  • TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

    Affected: through 5.10.9; from 6.0.0, fixed in 7.9.3; from 8.0.0, fixed in 8.5.1.

    Fixed in 7.9.3 (released May 19, 2026, 9 days before disclosure) and 8.5.1 (released May 19, 2026, 9 days before disclosure).

    The latest release, 8.10.1, is not affected.

  • TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

    Affected: from 6.8.0, fixed in 7.1.0.

    Fixed in 7.1.0 (released May 8, 2024, 750 days before disclosure).

    The latest release, 8.10.1, is not affected.

  • CVE-2024-38357Medium 6.1

    TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

    Affected: fixed in 5.11.0; from 6.0.0, fixed in 6.8.4; from 7.0.0, fixed in 7.2.0.

    Fixed in 6.8.4 (released Jun 19, 2024, the day of disclosure, the advisory names 5.11.0, which was never published) and 7.2.0 (released Jun 19, 2024, the day of disclosure).

    The latest release, 8.10.1, is not affected.

  • CVE-2024-38356Medium 6.1

    TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

    Affected: fixed in 5.11.0; from 6.0.0, fixed in 6.8.4; from 7.0.0, fixed in 7.2.0.

    Fixed in 6.8.4 (released Jun 19, 2024, the day of disclosure, the advisory names 5.11.0, which was never published) and 7.2.0 (released Jun 19, 2024, the day of disclosure).

    The latest release, 8.10.1, is not affected.

  • CVE-2024-29881Medium 4.3

    TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements

    Affected: fixed in 7.0.0.

    Fixed in 7.0.0 (released Mar 20, 2024, 6 days before disclosure).

    The latest release, 8.10.1, is not affected.

  • CVE-2024-29203Medium 4.3

    TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes

    Affected: fixed in 6.8.1.

    Fixed in 6.8.1 (released Nov 29, 2023, 118 days before disclosure).

    The latest release, 8.10.1, is not affected.

  • CVE-2024-21911Medium 6.1

    Cross-site scripting vulnerability in TinyMCE

    Affected: fixed in 5.6.0; fixed in 5.6.0.

    Fixed in 5.6.0 (released Nov 18, 2020, 1141 days before disclosure).

    The latest release, 8.10.1, is not affected.

  • CVE-2024-21910Medium 6.1

    Cross-site scripting vulnerability in TinyMCE plugins

    Affected: fixed in 5.10.0; fixed in 5.10.0.

    Fixed in 5.10.0 (released Oct 11, 2021, 814 days before disclosure).

    The latest release, 8.10.1, is not affected.

  • CVE-2024-21908Medium 6.1

    Cross-site scripting vulnerability in TinyMCE

    Affected: fixed in 5.9.0; fixed in 5.9.0.

    Fixed in 5.9.0 (released Aug 26, 2021, 860 days before disclosure).

    The latest release, 8.10.1, is not affected.

  • CVE-2023-48219Medium 6.1

    Special characters in unescaped text nodes can trigger mXSS in TinyMCE

    Affected: fixed in 5.10.9; from 6.0.0, fixed in 6.7.3.

    Fixed in 5.10.9 (released Nov 15, 2023, the day of disclosure) and 6.7.3 (released Nov 15, 2023, the day of disclosure).

    The latest release, 8.10.1, is not affected.

  • CVE-2023-45818Medium 6.1

    Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin

    Affected: from 6.0.0, fixed in 6.7.1; fixed in 5.10.8.

    Fixed in 5.10.8 (released Oct 19, 2023, the day of disclosure) and 6.7.1 (released Oct 19, 2023, the day of disclosure).

    The latest release, 8.10.1, is not affected.

  • CVE-2023-45819Medium 6.1

    Cross-site Scripting vulnerability in TinyMCE notificationManager.open API

    Affected: from 6.0.0, fixed in 6.7.1; fixed in 5.10.8.

    Fixed in 5.10.8 (released Oct 19, 2023, the day of disclosure) and 6.7.1 (released Oct 19, 2023, the day of disclosure).

    The latest release, 8.10.1, is not affected.

  • CVE-2022-23494Medium 5.4

    Cross-site scripting vulnerability in TinyMCE alerts

    Affected: from 6.0.0, fixed in 6.3.1; fixed in 5.10.7.

    Fixed in 5.10.7 (released Dec 7, 2022, 1 day before disclosure) and 6.3.1 (released Dec 6, 2022, 2 days before disclosure).

    The latest release, 8.10.1, is not affected.