plugin
9 known security issues reported for the Ultimate Tinymce WordPress plugin. Most recent disclosed Oct 30, 2024.
Running Ultimate Tinymce on your site? Check whether your installed version is affected.
Scan your site free[en] The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inje...
The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject ar...
Update plugin. An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress TinyMCE Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your s...
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update plugin.
The Ultimate TinyMCE plugin for WordPress is vulnerable to Cross-Site Scripting in versions before 3.6 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
The Ultimate TinyMCE plugin for WordPress is vulnerable to Cross-Site Scripting in versions before 3.6 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
[en] Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.
The Ultimate TinyMCE WordPress plugin was affected by a swfupload Cross-Site Scripting security vulnerability.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free