Changelog

Fixed stored XSS vulnerability using media plugin data-mce-object serialization.

Fixed stored XSS vulnerability using media plugin data-mce-object injection.

Fixed stored XSS vulnerability through mce:protected comments.

Fixed stored XSS vulnerability through data-mce- prefixed src, href, style attributes.

The default value of allow_html_in_comments will change from true to false in TinyMCE 8.x.

Updated dependencies and parsing logic for enhanced content sanitization. HTML-like content in comments and certain legacy patterns are now sanitized more strictly when xss_sanitization is enabled (default). The introduced allow_html_in_comments option provides control over comment node sanitization behavior.

Introduced allow_html_in_comments option (boolean, default: true) to control handling of HTML-like syntax in comment nodes. This option will default to false in TinyMCE 8.x.

Update Notices file and minified notices.

Added new disc style option for unordered lists.

New onboarding option.

The resize cursor now points in the correct direction for each resize mode. Patch contributed by daniloff200.

If style_formats is empty, the button is now disabled.

Inline dialog dropdowns reposition when the dialog is dragged or the window is scrolled.

Bullet list icons were have been updated to better represent the default styles.

The ContextFormSizeInput lock button is now centered instead of aligned to the end.

Changed the default value of advlist_bullet_styles option to default,disc,circle,square.

Autolink no longer overrides already existing links when autolinking.

Removed the deprecated CSS media selector -ms-high-contrast.

The mceInsertContent command no longer deletes the parent block element when an anchor is selected.

Table resizers are now visible when inline editor has a z-index property.

Tabbing inside a figcaption element no longer displays two text insertion carets.

Pressing Enter before a floating image no longer duplicates the image.

Editor did not scroll into viewport on receiving focus on Chrome and Safari.

Select UI elements were not properly styled on Chrome version 136.

New subtoolbar support for context toolbars.

New extended_mathml_attributes and extended_mathml_elements options.

Focus outline was misaligned with comment card border on saving an edit.

The editor.selection.scrollIntoView() method now pads the target scroll area with a small margin, ensuring content doesn’t sit at the very edge of the viewport.

Changed promotional text and link.

Setting editor height to a pt or em value was ignoring min/max height settings.

Error was thrown when pressing tab in the last cell of a non-editable table.

Error was thrown when trying to use the context form API after a component was detached.

Deleting an empty block within an <li> element would move cursor to the end of the <li>.

Deleting an empty block that was between two lists would throw an Error when all three elements were nested inside a list.

Skin UI content CSS was truncated when bundling, causing CSS styles to be missing.

Context forms used to disappear if their input were disabled on onSetup.

link_attributes_postprocess option that allows overriding attributes of a link that would be inserted through the link dialog.

Improved visual indication of a keyboard focus for a comment annotation when there is an image inside.

Not specifying a notification type (or specifying incorrect one) now defaults to 'info'.

Improved visual separation of comments side panel header.

Changed the link plugin behavior to move the cursor behind a link when inserted or edited via the UI. Patch contributed by Philipp91.

Keyboard navigation for size inputs in context forms.

Keyboard navigation for context form sliders.

The insertContent API was not replacing selected non-editable elements correctly.

Context toolbar inputs had incorrect margins.

Iframe aria text used to suggest to open help dialog even when the help plugin was not enabled.

Preview Dialog incorrectly opened anchor links in a new tab.

The float property was not properly removed on the image when converting a image into a captioned image.

Expanding selection to a word didn’t work inside inline editing host elements.

The semantics element in MathML was not properly retained when annotation elements was allowed.

It was possible to tab to a toolbar group that had all children disabled.

Keyboard navigation would get stuck on the 'more' toolbar button.

Toolbar groups had both a title attribute and a custom tooltip, causing overlapping tooltips.

Toolbar text field was properly rendering focus.

Text input was prevented in form elements in the contents of the editor.

Opening a notification when the toolbar is positioned at the bottom of the editor threw an error.

Table resize bars was not properly aligned for inline editors inside scrollable containers.

It is now possible to create labeled groups in context toolbars.

New back function in ContextFormApi to go back to the previous toolbar.

New QuickbarInsertImage command that is executed by the quickimage button.

New onSetup function to the context form API.

New placeholder to the context form input field API.

New disabled option to restore the previous readonly mode behavior, allowing the editor to be displayed in a disabled state.

Base64 data was not properly decoded due to unhandled URL-encoded characters.

The latin list style type is now recognized as an alias for the alpha list style type.

Image selection was removed when calling editor.nodeChanged() while having focus inside the editor UI.

Tooltip would not show for group toolbar button.

Changing the table row type when a contenteditable=false cell was selected would not work as expected.

The samp format was being applied as a block level format, instead of an inline format.

Removed title attribute from dialog tree elements as they already have a tooltip.

Fixed CSS bundling for skin UI content CSS.

Fixed incorrect resource keys for CSS bundling JS files.

Added support for using raw CSS in the list of possible colors, using the color_map_raw property.

Improved color picker aria support.

Autocompleter would not activate after applying an inline format like font size in some cases.

The toolbar-sticky-offset would still be applied after entering fullscreen mode.

Text and background color toolbar buttons would not be fully greyed out in readonly mode.

Closing a nested modal dialog would lose focus from the editor.

Inability to type { character on German keyboard layouts.

Invalid HTML elements within SVG elements were not removed.

New context property for all ui components.

Tree component now allows the addition of a custom icon.

New option allow_mathml_annotation_encodings to opt-in to keep math annotations with specific encodings.

In read-only mode the editor now allows normal cursor movement and block element selection, including video playback.

Pasting a table now places the cursor after the table instead of into the last cell.

Dialog list dropdown menus now close when the browser window resizes.

Mouse hover on partially visible dialog collection elements no longer scrolls.

Caret would unexpectedly shift to the non-editable table row above when pressing Enter.

Deleting a selection in a list element would sometimes prevent the input event from being dispatched.

Placing the cursor after a table with a br after it would misplace added newlines before the table instead of after.

Sidebar could not be toggled until the skin was loaded.

The image dialog lost focus after closing an image upload error alert.

Copying tables to the clipboard did not correctly separate cells and rows for the "text/plain" MIME type.

The editor resize handle was incorrectly rendered when all components were removed from the status bar.

Colorpicker number input fields now show an error tooltip and error icon when invalid text has been entered.

When a full document was loaded as editor content the head elements were added to the body.

Unnecessary nbsp entities were inserted when typing at the edges of inline elements.

Fixed JavaScript error when inserting a table using the context menu by adjusting the event order in renderInsertTableMenuItem.

Notifications didn’t position and resize properly when resizing the editor or toggling views.

The pattern commands would execute even if the command was not enabled.

Split button popups were incorrectly positioned when switching to fullscreen mode if the editor was inside a scrollable container.

Sequential html comments would in some cases generate unwanted elements.

The listbox component had a fixed width and was not a responsive ui element.

Prevent default mousedown on toolbar buttons was causing misplaced focus bugs.

Attempting to use focus commands on an editor where the cursor had last been in certain contentEditable="true" elements would fail.

Colorpicker’s hex-based input field showed the wrong validation error message.

Text content could move unexpectedly when deleting a paragraph.

Cursor would shift to the start of the editor body when focus was shifted to a noneditable cell of a table.

Long translations of the bottom help text would cause minor graphical issues.

Open Link button was disabled when selection partially covered a link or when multiple links were selected.

Added options.debug API that logs the initial raw editor options to console.

Added referrerpolicy as a valid attribute for an iframe element.

New onInit and stretched properties to the HtmlPanel dialog component.

Added support for querying the state of the mceTogglePlainTextPaste command.

Added for option to dialog label components to improve accessibility. The value must be another component on the same dialog.

Dialog slider components now emit an onChange event when using arrow keys.

Accessibility for element path buttons, added tooltip to describe the button and removed incorrect aria-level attribute.

Improve merging of inserted inline elements by removing nodes with redundant inheritable styles.

Improved Find & Replace dialog accessibility by changing placeholders to labels.

Replaced tiny branding logo with Build with TinyMCE text and logo.

Deleting in a div with preceding br elements would sometimes throw errors.

autoresize_bottom_margin was not reliably applied in some situations.

Fixed cases where adding a newline around a br, table or img would not move the cursor to a new line.

Focusing on contenteditable="true" element when using editable_root: false and inline mode causing selection to be shifted.

Corrected the role attribute on listbox dialog components to combobox when there are no nested menu items.

HTML entities that were double decoded in noscript elements caused an XSS vulnerability.

It was possible to inject XSS HTML that was not matching the regexp when using the noneditable_regexp option.

CSS color values set to transparent were incorrectly converted to #000000.

Insert/Edit image dialog lost focus after the image upload completed.

Deleting into a list from a paragraph that has an img tag could cause extra inline styles to be added.

Resolved an issue where emojis configured with the emojiimages database were not loading correctly due to a broken CDN.

Iframes in dialogs were not rendering rounded borders correctly.

Autocompleter possible values are no longer capped at a length of 10.

New math-equation icon.

Included itemprop, itemscope, and itemtype as valid HTML5 attributes in the core schema.

Improved accessibility for notifications: added tooltips, keyboard navigation, and a shortcut to focus on notifications.

Removed aria-pressed from the More button in sliding toolbar mode and replaced it with aria-expanded.

The editor UI now renders correctly in Windows High Contrast Mode.

Backspacing in certain HTML setups caused data to move around unexpectedly.

Dialog title markup was changed to use an h1 element instead of a div.

The dialog title was not announced in macOS VoiceOver; dialogs now use aria-label instead of aria-labelledby on macOS.

The theme loader did not respect the suffix when loading skin CSS files.

Custom block elements with colon characters would throw errors.

Tab navigation in views didn’t work.

Video and audio elements couldn’t be played on Safari.

The ToggleToolbarDrawer command did not toggle the toolbar in sliding mode when the skipFocus: true parameter was passed.

The buttons in the custom view header were clipped when overflowing.

In the custom view, the scrollbar of the container was not visible if its height was greater than the editor.

Fixed an accessibility issue by removing the duplicate role="menu" attribute from color swatches.

Fullscreen mode now prevents focus from leaving the editor.

The "Open Link" context menu action did not work when the selection surrounded a link.

Styles were not retained when toggling a list on and off.

Caret and placeholder text were invisible in Windows High Contrast Mode.

Firefox did not announce the iframe title when iframe_aria_text was set.

Notification width was not constrained to the width of the editor.

The "Open Link" context menu action was not enabled for links on images.

Fixed stored XSS vulnerability using sanitization bypass through nested SVGs.

Toggle list behavior generated wrong HTML when the forced_root_block option was set to div.

Tapping inside a composed text on Firefox Android would not close the autocompleter.

An inline editor toolbar now behaves correctly in horizontally scrolled containers.

Tooltips unintended shrinking and incorrectly positioned when shown in horizontally scrollable container.

The status bar was invisible when the editor’s height was set to the minimum.

New license_key option that must be set to gpl or a valid license key.

New custom tooltip functionality, tooltip will be shown when hovering with a mouse or with keyboard focus.

New sandbox_iframes_exclusions option that holds a list of URL host names to be excluded from iframe sandboxing when sandbox_iframes is set to true.

Added 'getAllEmojis' api function to the emoticons plugin.

Element preset support for the valid_children option and Schema.addValidChildren API.

A new trigger property for block text pattern configurations, allowing pattern activation with either Space or Enter keys.

Added onFocus callback for CustomEditor dialog component.

Added icons for the import from Word, export to Word and export to PDF premium plugins.

Added data is now a valid element in the Schema.

More advanced schema config for custom elements.

Added custom tooltip for autocompleter, now visible on both mouse hover and keyboard focus, except single column cases.

Added importword, exportpdf and exportword menu items to default file menu.

Included keyboard shortcut in custom tooltip for ToolbarButton and ToolbarToggleButton.

Improved showing which element has focus for keyboard navigation.

Custom tooltips will now show for items in collection which is rendered inside a dialog, on mouse hover and keyboard focus.

Autocompleter will now work with IMEs.

Make table ghost element better reflect height changes when resizing.

TinyMCE is now licensed GPL Version 2 or later.

convert_unsafe_embeds editor option is now defaulted to true.

sandbox_iframes editor option is now defaulted to true.

The DOMUtils.isEmpty API function has been modified to consider nodes containing only comments as empty.

The highlight_on_focus option now defaults to true, adding a focus outline to every editor.

Delay before the tooltip to show up, from 800ms to 300ms.

Now tox-view__pane has position: relative instead of static.

Update outbound link for statusbar Tiny logo.

Remove the height field from the table plugin cell dialog. The table plugin row dialog now controls the row height by setting the height on the tr element, not the td elements.

Change table height resizing handling to remove heights from td/th elements and only apply to tr elements.

Removed incorrect aria-placeholder attribute from editor body when placeholder option is set.

The tooltip property for dialog’s footer togglebutton is now optional.

Changed the media_url_resolver option to use promises.

Styles bespoke toolbar button fallback changed to Formats if Paragraph is not configured in style_formats option.

Updated deprecation/removed console message.

Deprecated force_hex_color option, with the default now being all colors are forced to hex format as lower case.

Deprecated remove_trailing_brs option from DomParser.

title attribute on buttons with visible label.

InsertOrderedList and InsertUnorderedList commands from core, these now only exist in the lists plugin.

closeButton from the notification API, close buttons in notifications are now required.

The autocompleter ch configuration property has been removed. Use the trigger property instead.

Deprecated template plugin.

When deleting the last row in a table, the cursor would jump to the first cell (top left), instead of moving to the next adjacent cell in some cases.

Heading formatting would be partially applied to the content within the summary element when the caret was positioned between words.

Moving focus to the outside of the editor after having clicked a menu would not fire a blur event as expected.

Autocomplete would sometimes cause corrupt data when starting during text composition.

Inline mode with persisted toolbar would show regardless of the skin being loaded, causing css issues.

Table classes couldn’t be removed via setting an empty value in table_class_list. Also fixed being forced to pick the first class option.

Directly right clicking on a ol’s li in FireFox didn’t enable the button List Properties…​ in the context menu.

The link_default_target option wasn’t considered when inserting a link via quicklink toolbar.

When inline editor toolbar wrapped to multiple lines the top wasn’t always calculated correctly.

Removed manually dispatching dragend event on drop in Firefox.

Slovenian help dialog content had a dot in the wrong place.

Pressing Backspace at the start of an empty summary element within a details element nested in a list item no longer removes the summary element.

The toolbar width was miscalculated for the inline editor positioned inside a scrollable container.

Fixed incorrect object processor for event_root option.

Adding newline after using selection.setContent to insert a block element would throw an unhandled exception.

Floating toolbar buttons in inline editor incorrectly wrapped into multiple rows on window resizing or zooming.

When setting table border width and table_style_by_css is true, only the border attribute is set to 0 and border-width styling is no longer used.

Clicking to the left or right of a non-editable div in Firefox would show two cursors.