{"items":[{"id":"CVE-2026-116675","published":"2026-10-27T16:47:01.183Z","updated":"2026-10-28T16:15:12.999Z","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization","severity":"HIGH","score":8.5,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2026-47762","published":"2026-05-28T15:21:36.882Z","updated":"2026-05-28T19:14:42.376Z","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments","severity":"HIGH","score":8.7,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-47761","published":"2026-05-28T15:20:57.814Z","updated":"2026-05-28T15:26:49.455Z","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection","severity":"HIGH","score":8.7,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-47759","published":"2026-05-28T15:20:11.242Z","updated":"2026-05-30T01:58:37.777Z","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes","severity":"HIGH","score":8.7,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-47760","published":"2026-05-28T15:18:22.509Z","updated":"2026-06-02T15:58:47.216Z","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs","severity":"HIGH","score":8.7,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2024-38357","published":"2024-06-19T20:03:49.806Z","updated":"2024-08-02T04:04:25.258Z","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements","severity":"MEDIUM","score":6.1,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2024-38356","published":"2024-06-19T20:03:47.923Z","updated":"2024-08-02T04:04:25.245Z","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option","severity":"MEDIUM","score":6.1,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2024-29881","published":"2024-03-26T13:31:15.375Z","updated":"2024-08-02T17:59:24.301Z","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements","severity":"MEDIUM","score":4.3,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.00713,"kevAdded":null},{"id":"CVE-2024-29203","published":"2024-03-26T13:23:53.673Z","updated":"2024-08-06T14:37:35.656Z","title":"TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes","severity":"MEDIUM","score":4.3,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.00713,"kevAdded":null},{"id":"CVE-2023-48219","published":"2023-11-15T18:59:03.776Z","updated":"2024-08-29T17:42:00.819Z","title":"Special characters in unescaped text nodes can trigger mXSS in TinyMCE","severity":"MEDIUM","score":6.1,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.00715,"kevAdded":null},{"id":"CVE-2023-45818","published":"2023-10-19T21:18:01.297Z","updated":"2024-09-12T15:36:41.178Z","title":"Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin","severity":"MEDIUM","score":6.1,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.00759,"kevAdded":null},{"id":"CVE-2023-45819","published":"2023-10-19T21:13:07.155Z","updated":"2024-09-12T17:49:09.927Z","title":"Cross-site Scripting vulnerability in TinyMCE notificationManager.open API","severity":"MEDIUM","score":6.1,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.00634,"kevAdded":null},{"id":"CVE-2022-23494","published":"2022-12-08T21:29:26.610Z","updated":"2025-04-23T16:30:57.118Z","title":"Cross-site scripting vulnerability in TinyMCE alerts","severity":"MEDIUM","score":5.4,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.01015,"kevAdded":null},{"id":"CVE-2019-1010091","published":"2019-07-17T16:35:10.000Z","updated":"2024-08-05T03:07:18.162Z","title":"tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The…","severity":"MEDIUM","score":6.1,"vendor":"tinymce","product":"tinymce","kev":false,"epss":0.01917,"kevAdded":null}]}