High
CVE-2026-47761
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 30
Reset filters
High
CVE-2026-47762
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
High
CVE-2026-47759
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
High
CVE-2026-47760
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Medium
CVE-2026-34974
phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation
Medium
CVE-2025-62418
bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG)
Medium
CVE-2025-62415
bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML)
Medium
ghsa-52cw-pvq9-9m5v
Silverstripe uses TinyMCE which allows svg files linked in object tags
Medium
CVE-2024-38356
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
Medium
CVE-2024-38357
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
Medium
ghsa-vjwg-28gv-pm8h
Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881
Medium
CVE-2024-29203
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
Medium
CVE-2024-29881
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
High
ghsa-9j5w-2cqc-cwj9
Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor
Medium
CVE-2023-48219
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
Medium
CVE-2023-45819
TinyMCE XSS vulnerability in notificationManager.open API
Medium
CVE-2023-45818
TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin
Medium
ghsa-jxcx-3h54-qqxx
SilverStripe CMS Cross-site Scripting vulnerabilities inherited from TinyMCE
Medium
ghsa-4q66-g4mm-8rg5
Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE
Medium
CVE-2023-30943
Moodle External Control of File Name or Path vulnerability
Medium
ghsa-wqm8-jx8r-8rcq
Cross-site scripting vulnerabilities in old version of bundled TinyMCE
Medium
CVE-2022-23494
Cross-site scripting vulnerability in TinyMCE alerts
Medium
CVE-2019-7866
Magento 2 Community Edition XSS Vulnerability
Medium
CVE-2012-6112
PHP Spellchecker addon for TinyMCE allows attackers to trigger arbitrary outbound HTTP requests
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.