tinymce/tinymce vulnerabilities

Web based JavaScript HTML WYSIWYG editor control.

Registry
Composer
Latest
8.10.0
License
SEE LICENSE IN license.md
Source
github.com/tinymce/tinymce-dist (opens the source repository in a new tab)

15 known advisories

The latest version, 8.10.0, is not affected by any of them. Projects on older versions may be.

Update to the latest version:composer require tinymce/tinymce:^8.10.0

Security advisories for tinymce/tinymce

  • HighGHSA-vg35-5wq7-3x7w5 Jun 2026

    TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

    Affected
    <=5.10.9 · >=6.0.0 <7.9.3 · >=8.0.0 <8.5.1
    Fixed in
    7.9.3, 8.5.1
  • HighGHSA-v98h-vmpc-fpqv5 Jun 2026

    TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

    Affected
    <=5.10.9 · >=6.0.0 <7.9.3 · >=8.0.0 <8.5.1
    Fixed in
    7.9.3, 8.5.1
  • HighGHSA-q742-qvgc-gc2f5 Jun 2026

    TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

    Affected
    <=5.10.9 · >=6.0.0 <7.9.3 · >=8.0.0 <8.5.1
    Fixed in
    7.9.3, 8.5.1
  • HighGHSA-mh5m-5hw4-5c695 Jun 2026

    TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

    Affected
    >=6.8.0 <7.1.0
    Fixed in
    7.1.0
  • MediumGHSA-9hcv-j9pv-qmph19 Jun 2024

    TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

    Affected
    <5.11.0 · >=6.0.0 <6.8.4 · >=7.0.0 <7.2.0
    Fixed in
    5.11.0, 6.8.4, 7.2.0
  • MediumGHSA-w9jx-4g6g-rp7x19 Jun 2024

    TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

    Affected
    <5.11.0 · >=6.0.0 <6.8.4 · >=7.0.0 <7.2.0
    Fixed in
    5.11.0, 6.8.4, 7.2.0
  • MediumGHSA-438c-3975-5x3f26 Mar 2024

    TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes

    Affected
    <6.8.1
    Fixed in
    6.8.1
  • MediumGHSA-5359-pvf2-pw7826 Mar 2024

    TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements

    Affected
    <7.0.0
    Fixed in
    7.0.0
  • MediumGHSA-v626-r774-j7f815 Nov 2023

    TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes

    Affected
    <5.10.9 · >=6.0.0 <6.7.3
    Fixed in
    5.10.9, 6.7.3
  • MediumGHSA-hgqx-r2hp-jr3819 Oct 2023

    TinyMCE XSS vulnerability in notificationManager.open API

    Affected
    >=6.0.0 <6.7.1 · <5.10.8
    Fixed in
    5.10.8, 6.7.1
  • MediumGHSA-v65r-p3vv-jjfv19 Oct 2023

    TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin

    Affected
    >=6.0.0 <6.7.1 · <5.10.8
    Fixed in
    5.10.8, 6.7.1
  • MediumGHSA-gg8r-xjwq-4w928 Dec 2022

    Cross-site scripting vulnerability in TinyMCE alerts

    Affected
    >=6.0.0 <6.3.1 · <5.10.7
    Fixed in
    5.10.7, 6.3.1
  • MediumGHSA-r8hm-w5f7-wj392 Nov 2021

    Cross-site scripting vulnerability in TinyMCE plugins

    Affected
    <5.10.0
    Fixed in
    5.10.0
  • MediumGHSA-5h9g-x5rv-25wg22 Oct 2021

    Cross-site scripting vulnerability in TinyMCE

    Affected
    <5.9.0
    Fixed in
    5.9.0
  • MediumGHSA-w7jx-j77m-wp656 Jan 2021

    Cross-site scripting vulnerability in TinyMCE

    Affected
    <5.6.0
    Fixed in
    5.6.0

Which of your client projects still run an old tinymce/tinymce?

NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other Composer packages

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.