Cross-site scripting vulnerability in TinyMCE plugins
Summary
CVE-2024-21910: Cross-site scripting vulnerability in TinyMCE plugins. Affects tinymce versions < 5.10.0. Fixed in 5.10.0. How to fix ↓
Also tracked for
- django-tinymce · PyPI
The same CVE-2024-21910 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinyMCE is a popular open-source WYSIWYG editor used for rich text editing in web applications. It provides a user-friendly interface for creating and editing content. The 'image' and 'link' plugins in TinyMCE allow users to insert and update images and links within the editor. However, a cross-site scripting (XSS) vulnerability was discovered in the URL processing logic of these plugins.
Vulnerability Detail
The XSS vulnerability in TinyMCE's 'image' and 'link' plugins allowed for arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This could potentially lead to unauthorized access, data theft, or other malicious activities. The vulnerability only affected users while editing and the dangerous URLs were stripped in any content extracted from the editor. The impact of this vulnerability is moderate, and it affects all users using TinyMCE 5.9.2 or lower.
How To Fix
Latest published version: 8.10.0 as of 23 Oct 2026
npm install tinymce@8.10.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.10.0
This is the first release that contains the fix.
npm install tinymce@5.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the 'image' and 'link' plugins in TinyMCE. This can be done by modifying the configuration of the editor to exclude these plugins. However, this workaround may limit the functionality of the editor in terms of image and link manipulation.
Conclusion
The XSS vulnerability in TinyMCE's 'image' and 'link' plugins can be mitigated by upgrading to version 5.10.0 or higher. Alternatively, users can temporarily disable the affected plugins. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tinymce →
FAQ
The vulnerability allows for arbitrary JavaScript execution, which can lead to unauthorized access, data theft, or other malicious activities. However, the impact is limited to users while editing, and dangerous URLs are stripped in extracted content.
TinyMCE versions 5.9.2 and lower are affected by this vulnerability.
To fix this vulnerability, upgrade to TinyMCE 5.10.0 or higher, which includes the necessary patches.
Yes, you can disable the 'image' and 'link' plugins in TinyMCE as a temporary workaround. However, this may limit certain functionality.
The vulnerability was discovered by Yakir6 and reported to Tiny Technologies.
References
Related vulnerabilities
Recent vulnerabilities recorded for tinymce.
