CVE Feed

    Dashboard / CVE / CVE-2012-4230

    CVE-2012-4230

    The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors, as demonstrated using a textarea element.

    Published:Apr 25, 2014
    Last Modified:Apr 12, 2025
    EPS:Apr 25, 2014
    EPSS Score:0.00621
    CVSS Score:4.3

    Affected Products

    Vendor
    Tinymce
    Product
    Tinymce

    Exploits

    http://packetstormsecurity.com/files/120750/TinyMCE-3.5.8-Cross-Site-Scripting.htmlhttp://seclists.org/fulldisclosure/2013/Mar/114http://www.madirish.net/554http://packetstormsecurity.com/files/120750/TinyMCE-3.5.8-Cross-Site-Scripting.htmlhttp://seclists.org/fulldisclosure/2013/Mar/114http://www.madirish.net/554

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-47762 (CVSS 8.7) — TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerabi…
    CVE-2026-47761 (CVSS 8.7) — TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerabi…
    CVE-2026-47759 (CVSS 8.7) — TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerabi…
    CVE-2026-47760 (CVSS 8.7) — TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability …
    CVE-2024-38357 (CVSS 6.1) — TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyM…
    CVE-2024-38356 (CVSS 6.1) — TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyM…
    CVE-2024-29881 (CVSS 4.3) — TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in Tiny…
    CVE-2024-29203 (CVSS 4.3) — TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyM…
    CVE-2011-4825 (CVSS 7.5) — Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as use…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High