PatchTheCVEtinymce vulnerabilities
Recent CVEs affecting tinymce products. 6 tracked.
tinymce has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2014-05-22. Highest priority: CVE-2012-3414 (score 44/100).
- CVE-2014-3845 MEDIUM 6.8 UPGRADE Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress al
- CVE-2014-3844 MEDIUM 5.0 UPGRADE The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows rem
- CVE-2013-2204 MEDIUM 4.3 MITIGATE UPGRADE moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and oth
- CVE-2012-6112 MEDIUM 5.0 DOWNGRADE DOWNGRADE classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as
- CVE-2012-4230 MEDIUM 4.3 DOWNGRADE The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding
- CVE-2012-3414 MEDIUM 4.3 UPGRADE DOWNGRADE Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPre
FAQ
How do I fix tinymce vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is tinymce being exploited right now?
None of the tracked tinymce CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which tinymce CVE should I patch first?
CVE-2012-3414 currently ranks highest (44/100): Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPre.