{"schema_version":1,"title":"TinyMCE vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 6 vulnerabilities in TinyMCE: 0 in the last 7 days and 2 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116675, was published on 27 October 2026. 2 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/vendors/tinymce","json_url":"https://junglewise.ai/threats/vendors/tinymce.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/tinymce","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":4,"all_time":6,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":2,"last_90_days":2,"last_365_days":4},"latest":[{"cve":"CVE-2026-116675","cvss":4,"slug":"cve-2026-116675-tinymce-is-an-open-source-rich-text-editor-from-7-9-3-until-7-9","title":"TinyMCE media plugin stored cross-site scripting","severity":"high","exploited":false,"published_at":"2026-10-27T17:16:59.617+00:00","url":"https://junglewise.ai/threats/cve-2026-116675-tinymce-is-an-open-source-rich-text-editor-from-7-9-3-until-7-9"},{"cve":"CVE-2012-20002","cvss":7.5,"slug":"cve-2012-20002-tinymce-thumbnail-gallery-plugin-for-wordpress-before-1-1-0","title":"TinyMCE Thumbnail Gallery path traversal file read","severity":"high","exploited":false,"published_at":"2026-10-20T21:17:10.613+00:00","url":"https://junglewise.ai/threats/cve-2012-20002-tinymce-thumbnail-gallery-plugin-for-wordpress-before-1-1-0"},{"cve":"CVE-2026-47761","cvss":8.7,"epss":0.0041,"slug":"cve-2026-47761-tiny-technologies-tinymce-stored-xss-in-media-plugin","title":"Tiny Technologies TinyMCE stored XSS in media plugin","severity":"high","exploited":false,"published_at":"2026-05-28T16:16:28.337+00:00","url":"https://junglewise.ai/threats/cve-2026-47761-tiny-technologies-tinymce-stored-xss-in-media-plugin"},{"cve":"CVE-2026-47759","cvss":8.7,"epss":0.0042,"slug":"cve-2026-47759-tinymce-stored-xss-via-unsanitized-data-mce-attributes","title":"TinyMCE stored XSS via unsanitized data-mce attributes","severity":"high","exploited":false,"published_at":"2026-05-28T16:16:28.07+00:00","url":"https://junglewise.ai/threats/cve-2026-47759-tinymce-stored-xss-via-unsanitized-data-mce-attributes"},{"cve":"CVE-2024-29203","cvss":3.1,"epss":0.0071,"slug":"cve-2024-29203-tinymce-cross-site-scripting-in-iframe-handling","title":"TinyMCE cross-site scripting in iframe handling","severity":"low","exploited":false,"published_at":"2024-03-26T21:23:47+00:00","url":"https://junglewise.ai/threats/cve-2024-29203-tinymce-cross-site-scripting-in-iframe-handling"},{"cvss":6.1,"slug":"tinymce-cross-site-scripting-in-image-and-link-plugins-3438ab76","title":"TinyMCE cross-site scripting in image and link plugins","severity":"info","exploited":false,"published_at":"2024-01-03T18:30:51+00:00","url":"https://junglewise.ai/threats/tinymce-cross-site-scripting-in-image-and-link-plugins-3438ab76"}],"vendor":{"hub":true,"name":"TinyMCE","slug":"tinymce","description":"Provider of a rich text editing platform for web applications.","url":"https://junglewise.ai/threats/vendors/tinymce"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-47759","cvss":8.7,"epss":0.0042,"slug":"cve-2026-47759-tinymce-stored-xss-via-unsanitized-data-mce-attributes","title":"TinyMCE stored XSS via unsanitized data-mce attributes","severity":"high","exploited":false,"published_at":"2026-05-28T16:16:28.07+00:00","url":"https://junglewise.ai/threats/cve-2026-47759-tinymce-stored-xss-via-unsanitized-data-mce-attributes"},{"cve":"CVE-2026-47761","cvss":8.7,"epss":0.0041,"slug":"cve-2026-47761-tiny-technologies-tinymce-stored-xss-in-media-plugin","title":"Tiny Technologies TinyMCE stored XSS in media plugin","severity":"high","exploited":false,"published_at":"2026-05-28T16:16:28.337+00:00","url":"https://junglewise.ai/threats/cve-2026-47761-tiny-technologies-tinymce-stored-xss-in-media-plugin"},{"cve":"CVE-2012-20002","cvss":7.5,"slug":"cve-2012-20002-tinymce-thumbnail-gallery-plugin-for-wordpress-before-1-1-0","title":"TinyMCE Thumbnail Gallery path traversal file read","severity":"high","exploited":false,"published_at":"2026-10-20T21:17:10.613+00:00","url":"https://junglewise.ai/threats/cve-2012-20002-tinymce-thumbnail-gallery-plugin-for-wordpress-before-1-1-0"},{"cve":"CVE-2026-116675","cvss":4,"slug":"cve-2026-116675-tinymce-is-an-open-source-rich-text-editor-from-7-9-3-until-7-9","title":"TinyMCE media plugin stored cross-site scripting","severity":"high","exploited":false,"published_at":"2026-10-27T17:16:59.617+00:00","url":"https://junglewise.ai/threats/cve-2026-116675-tinymce-is-an-open-source-rich-text-editor-from-7-9-3-until-7-9"},{"cve":"CVE-2024-29203","cvss":3.1,"epss":0.0071,"slug":"cve-2024-29203-tinymce-cross-site-scripting-in-iframe-handling","title":"TinyMCE cross-site scripting in iframe handling","severity":"low","exploited":false,"published_at":"2024-03-26T21:23:47+00:00","url":"https://junglewise.ai/threats/cve-2024-29203-tinymce-cross-site-scripting-in-iframe-handling"},{"cvss":6.1,"slug":"tinymce-cross-site-scripting-in-image-and-link-plugins-3438ab76","title":"TinyMCE cross-site scripting in image and link plugins","severity":"info","exploited":false,"published_at":"2024-01-03T18:30:51+00:00","url":"https://junglewise.ai/threats/tinymce-cross-site-scripting-in-image-and-link-plugins-3438ab76"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[]}