CVE-2012-4230: Tinymce

Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days.

The bbcode plugin in TinyMCE 3.5.8 does not properly enforce the TinyMCE security policy for the (1) encoding directive and (2) valid_elements attribute, which allows attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors, as demonstrated using a textarea element.

Affected products

• Tinymce Tinymce: version 3.5.8 only

Published 2014-04-25. Last modified 2026-06-16.