tinymce

Every one of the 15 is a mark on the map. Named now: 1 to 15, most at risk first.

1. tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media eleme…CVE-2019-1010091tinymce · 1.9% likely

   CWE-79

2. The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to…CVE-2012-4230Tinymce · 1.4% likely

   CWE-264

3. Cross-site scripting vulnerability in TinyMCE alertsCVE-2022-23494tinymce · CVSS 5.4 · 1.1% likely

   CWE-79

4. Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave pluginCVE-2023-45818tinymce · CVSS 6.1 · 0.8% likely

   CWE-79

5. Special characters in unescaped text nodes can trigger mXSS in TinyMCECVE-2023-48219tinymce · CVSS 6.1 · 0.7% likely

   CWE-79

6. TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elementsCVE-2024-29881tinymce · CVSS 4.3 · 0.7% likely

   CWE-79

7. TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframesCVE-2024-29203tinymce · CVSS 4.3 · 0.7% likely

   CWE-79

8. Cross-site Scripting vulnerability in TinyMCE notificationManager.open APICVE-2023-45819tinymce · CVSS 6.1 · 0.6% likely

   CWE-79

9. TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elementsCVE-2024-38357tinymce · CVSS 6.1 · 0.5% likely

   CWE-79

10. TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp optionCVE-2024-38356tinymce · CVSS 6.1 · 0.5% likely

    CWE-79

11. TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serializationCVE-2026-116675tinymce · CVSS 8.5 · 0.3% likely

    CWE-79

12. TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` commentsCVE-2026-47762tinymce · CVSS 8.7 · 0.3% likelycovered by CyberSIXT

    CWE-79

13. TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributesCVE-2026-47759tinymce · CVSS 8.7 · 0.3% likelycovered by CyberSIXT

    CWE-79

14. TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injectionCVE-2026-47761tinymce · CVSS 8.7 · 0.3% likelycovered by CyberSIXT

    CWE-79

15. TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGsCVE-2026-47760tinymce · CVSS 8.7 · 0.2% likelycovered by CyberSIXT

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.