CVE Field Guide
About Us
CVE-2026-65535
PUBLISHED
WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability
Assigner:
Patchstack
Reserved:
22.07.2026
Published:
23.07.2026
Updated:
23.07.2026
Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.
Metrics
CVSS 3.1
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score:
4.3
CVSS score
4.3
Attack Vector
Network
Scope
Unchanged
Attack Complexity
Low
Confidentiality Impact
Low
Privileges Required
Low
Integrity Impact
None
User Interaction
None
Availability Impact
None
CVSS 3.1
Product Status
Vendor
Takayuki Miyauchi
Product
TinyMCE Templates
Versions
Default:
unaffected
affected from n/a to 4.8.1 (incl.)
Credits
Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program
finder
References
https://patchstack.com/database/wordpress/plugin/tinymce-templates/vulnerability/wordpress-tinymce-templates-plugin-4-8-1-sensitive-data-exposure-vulnerability?_s_id=cve
Problem Types
CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
CWE
Impacts
CAPEC-37 Retrieve Embedded Sensitive Data