tiny has 6 CVEs on record between 2024 and 2026. The busiest recent month was May 2026 with 4. The median CVSS is 8.7 (high). None have a confirmed exploitation report. The most common weakness class is CWE-79 (6).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.7
- Publish → KEV
- —
- Last 90 days
- 0 prev 4
Weakness classes
Products
- tinymce 6
Worst active — by depth score
CVE-2026-47761High· 8.7TinyMCE is an open source rich text editor60CVE-2026-47762High· 8.7TinyMCE is an open source rich text editor48CVE-2026-47760High· 8.7TinyMCE is an open source rich text editor48CVE-2026-47759High· 8.7TinyMCE is an open source rich text editor48CVE-2024-21911Medium· 6.1TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability34
tiny vulnerabilities
CVEs affecting tiny, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-47762High· 8.7TinyMCE is an open source rich text editor
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is…
CVE-2026-47761High· 8.7PoCTinyMCE is an open source rich text editor
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when con…
CVE-2026-47760High· 8.7TinyMCE is an open source rich text editor
TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute …
CVE-2026-47759High· 8.7TinyMCE is an open source rich text editor
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious …
CVE-2024-21911Medium· 6.1TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability
TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's bro…
CVE-2024-21908Medium· 6.1TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability
TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's bro…