CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2020-17480
Medium (6.1) in tiny tinymce. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in tinymce 4.9.7, 5.1.4.
TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- tiny:tinymce
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-27gm-ghr9-4v95 | npm | tinymce | <4.9.7 | 4.9.7 |
| GHSA-27gm-ghr9-4v95 | npm | tinymce | >=5.0.0 <5.1.4 | 5.1.4 |