# TinyMCE (NuGet) vulnerabilities 16 known vulnerabilities (5 high, 11 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 8.10.1 (Oct 28, 2026): no advisory affects it - Newest unaffected release: 8.10.1 (Oct 28, 2026), the latest release - Releases: 258 since 3.4.3.2 (Aug 3, 2011) - Registry: https://www.nuget.org/packages/TinyMCE - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-116675: 7.9.3 (8.0.0 is outside it); 8.5.1 to 8.9.2 (8.9.3 is outside it) - CVE-2026-47762: 3.4.3.2 to 7.9.2 (7.9.3 is outside it); 8.0.0 to 8.5.0 (8.5.1 is outside it) - CVE-2026-47761: 3.4.3.2 to 7.9.2 (7.9.3 is outside it); 8.0.0 to 8.5.0 (8.5.1 is outside it) - CVE-2026-47759: 3.4.3.2 to 7.9.2 (7.9.3 is outside it); 8.0.0 to 8.5.0 (8.5.1 is outside it) - CVE-2026-47760: 6.8.0 to 7.0.1 (7.1.0 is outside it) - CVE-2024-38357: 3.4.3.2 to 6.8.3 (6.8.4 is outside it); 7.0.0 to 7.1.2 (7.2.0 is outside it) - CVE-2024-38356: 3.4.3.2 to 6.8.3 (6.8.4 is outside it); 7.0.0 to 7.1.2 (7.2.0 is outside it) - CVE-2024-29881: 3.4.3.2 to 6.8.6 (7.0.0 is outside it) - CVE-2024-29203: 3.4.3.2 to 6.8.0 (6.8.1 is outside it) - CVE-2024-21911: 3.4.3.2 to 5.5.1 (5.6.0 is outside it) - CVE-2024-21910: 3.4.3.2 to 5.9.2 (5.10.0 is outside it) - CVE-2024-21908: 3.4.3.2 to 5.8.2 (5.9.0 is outside it) - CVE-2023-48219: 3.4.3.2 to 5.10.8 (5.10.9 is outside it); 6.0.0 to 6.7.2 (6.7.3 is outside it) - CVE-2023-45818: 3.4.3.2 to 5.10.7 (5.10.8 is outside it); 6.0.0 to 6.7.0 (6.7.1 is outside it) - CVE-2023-45819: 3.4.3.2 to 5.10.7 (5.10.8 is outside it); 6.0.0 to 6.7.0 (6.7.1 is outside it) - CVE-2022-23494: 3.4.3.2 to 5.10.6 (5.10.7 is outside it); 6.0.0 to 6.3.0 (6.3.1 is outside it) ## Advisories (16) ### [CVE-2026-116675](https://cve.now/CVE-2026-116675): TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin \`data-mce-object\` serialization - Severity: High 8.5 - Published: Oct 27, 2026 - Affected: from 8.5.1, fixed in 8.9.3; from 7.9.3, fixed in 7.9.4. - Fixed in 8.0.0 (released Jul 23, 2025, 461 days before disclosure, the advisory names 7.9.4, which was never published) and 8.9.3 (released Oct 6, 2026, 21 days before disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2026-47762](https://cve.now/CVE-2026-47762): TinyMCE Cross-Site Scripting (XSS) vulnerability through \`mce:protected\` comments - Severity: High 8.7 - Published: May 28, 2026 - Affected: through 5.10.9; from 6.0.0, fixed in 7.9.3; from 8.0.0, fixed in 8.5.1. - Fixed in 7.9.3 (released May 19, 2026, 9 days before disclosure) and 8.5.1 (released May 19, 2026, 9 days before disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2026-47761](https://cve.now/CVE-2026-47761): TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin \`data-mce-object\` injection - Severity: High 8.7 - Published: May 28, 2026 - Affected: through 5.10.9; from 6.0.0, fixed in 7.9.3; from 8.0.0, fixed in 8.5.1. - Fixed in 7.9.3 (released May 19, 2026, 9 days before disclosure) and 8.5.1 (released May 19, 2026, 9 days before disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2026-47759](https://cve.now/CVE-2026-47759): TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - Severity: High 8.7 - Published: May 28, 2026 - Affected: through 5.10.9; from 6.0.0, fixed in 7.9.3; from 8.0.0, fixed in 8.5.1. - Fixed in 7.9.3 (released May 19, 2026, 9 days before disclosure) and 8.5.1 (released May 19, 2026, 9 days before disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2026-47760](https://cve.now/CVE-2026-47760): TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - Severity: High 8.7 - Published: May 28, 2026 - Affected: from 6.8.0, fixed in 7.1.0. - Fixed in 7.1.0 (released May 8, 2024, 750 days before disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2024-38357](https://cve.now/CVE-2024-38357): TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements - Severity: Medium 6.1 - Published: Jun 19, 2024 - Affected: fixed in 5.11.0; from 6.0.0, fixed in 6.8.4; from 7.0.0, fixed in 7.2.0. - Fixed in 6.8.4 (released Jun 19, 2024, the day of disclosure, the advisory names 5.11.0, which was never published) and 7.2.0 (released Jun 19, 2024, the day of disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2024-38356](https://cve.now/CVE-2024-38356): TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable\_regexp option - Severity: Medium 6.1 - Published: Jun 19, 2024 - Affected: fixed in 5.11.0; from 6.0.0, fixed in 6.8.4; from 7.0.0, fixed in 7.2.0. - Fixed in 6.8.4 (released Jun 19, 2024, the day of disclosure, the advisory names 5.11.0, which was never published) and 7.2.0 (released Jun 19, 2024, the day of disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2024-29881](https://cve.now/CVE-2024-29881): TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - Severity: Medium 4.3 - Published: Mar 26, 2024 - Affected: fixed in 7.0.0. - Fixed in 7.0.0 (released Mar 20, 2024, 6 days before disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2024-29203](https://cve.now/CVE-2024-29203): TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes - Severity: Medium 4.3 - Published: Mar 26, 2024 - Affected: fixed in 6.8.1. - Fixed in 6.8.1 (released Nov 29, 2023, 118 days before disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2024-21911](https://cve.now/CVE-2024-21911): Cross-site scripting vulnerability in TinyMCE - Severity: Medium 6.1 - Published: Jan 3, 2024 - Affected: fixed in 5.6.0; fixed in 5.6.0. - Fixed in 5.6.0 (released Nov 18, 2020, 1141 days before disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2024-21910](https://cve.now/CVE-2024-21910): Cross-site scripting vulnerability in TinyMCE plugins - Severity: Medium 6.1 - Published: Jan 3, 2024 - Affected: fixed in 5.10.0; fixed in 5.10.0. - Fixed in 5.10.0 (released Oct 11, 2021, 814 days before disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2024-21908](https://cve.now/CVE-2024-21908): Cross-site scripting vulnerability in TinyMCE - Severity: Medium 6.1 - Published: Jan 3, 2024 - Affected: fixed in 5.9.0; fixed in 5.9.0. - Fixed in 5.9.0 (released Aug 26, 2021, 860 days before disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2023-48219](https://cve.now/CVE-2023-48219): Special characters in unescaped text nodes can trigger mXSS in TinyMCE - Severity: Medium 6.1 - Published: Nov 15, 2023 - Affected: fixed in 5.10.9; from 6.0.0, fixed in 6.7.3. - Fixed in 5.10.9 (released Nov 15, 2023, the day of disclosure) and 6.7.3 (released Nov 15, 2023, the day of disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2023-45818](https://cve.now/CVE-2023-45818): Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin - Severity: Medium 6.1 - Published: Oct 19, 2023 - Affected: from 6.0.0, fixed in 6.7.1; fixed in 5.10.8. - Fixed in 5.10.8 (released Oct 19, 2023, the day of disclosure) and 6.7.1 (released Oct 19, 2023, the day of disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2023-45819](https://cve.now/CVE-2023-45819): Cross-site Scripting vulnerability in TinyMCE notificationManager.open API - Severity: Medium 6.1 - Published: Oct 19, 2023 - Affected: from 6.0.0, fixed in 6.7.1; fixed in 5.10.8. - Fixed in 5.10.8 (released Oct 19, 2023, the day of disclosure) and 6.7.1 (released Oct 19, 2023, the day of disclosure). - The latest release, 8.10.1, is not affected. ### [CVE-2022-23494](https://cve.now/CVE-2022-23494): Cross-site scripting vulnerability in TinyMCE alerts - Severity: Medium 5.4 - Published: Dec 8, 2022 - Affected: from 6.0.0, fixed in 6.3.1; fixed in 5.10.7. - Fixed in 5.10.7 (released Dec 7, 2022, 1 day before disclosure) and 6.3.1 (released Dec 6, 2022, 2 days before disclosure). - The latest release, 8.10.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/nuget/tinymce Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.