TinyMCE Color Picker

TinyMCE Color Picker has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2014; all 2 are fixed as of September 2026. Their average CVSS score is 4.8, and the most serious one scores 5.3 out of 10. 2014 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 2 issues recorded for TinyMCE Color Picker has a vendor fix available, so running the current release closes all known holes.

TinyMCE Color Picker is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 3.9.40.

Strategic Overview

Avg CVSSMedium

4.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all TinyMCE Color Picker vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2014-3844

TinyMCE Color Picker <= 1.1 - Missing Authorization

Read the full analysis

Vulnerability Records

2 records


2014-05-01 00:00	TinyMCE Color Picker < 1.2 - Cross-Site Request Forgery TinyMCE Color Picker < 1.2	`CVE-2014-3845`	4.3 Medium	Anonymous	Yes
2014-04-28 00:00	TinyMCE Color Picker <= 1.1 - Missing Authorization TinyMCE Color Picker <= 1.1	`CVE-2014-3844`	5.3 Medium	Anonymous	Yes

Showing 1–2 of 2 reports

Plugin Profile

Latestv1.3

TinyMCE Color Picker

Author

iseulde

5.0(21)

100/100

Last Updated

2017-11-28 (9y ago)

Active Installs

1,000+

Downloads

19,993

Requires WP

3.9+

Requires PHP

Tested up to

WP 3.9.40

Created

2014-04-26 (13y ago)

This plugin adds and advanced color picker to the editor. You’ll have the ability to add custom colors with a color picker, a feature that has been removed from WordPress 3.9. It only works for WordPress 3.9 and higher.

View on WordPress.org