TinyMCE 6 end of life: what to do in 2026

TinyMCE 6.8.6, released on 29 May 2025, is the last TinyMCE under the MIT license, and the 6.x line gets no more releases. TinyMCE 7 and 8 are maintained, but they are licensed under the GPL or commercially. If your website or product runs TinyMCE 6, or the even older 4 or 5, you have four ways forward. Here is what each of them means for the security of your content, for your license and for the plugins you use.

Where TinyMCE stands in October 2026

Is TinyMCE 6 still safe to use?

Six publicly documented vulnerabilities (CVEs) are open in TinyMCE 6.8.6, and no MIT-licensed TinyMCE release is going to close them. All six are cross-site scripting (XSS): content crafted by an attacker runs its script in the browser of a user who edits or views it.

How much that matters depends on who writes your content. If only you and your colleagues do, the risk is small. If people you do not fully trust can put content into the editor (comments, forums, user profiles, a multi-author CMS, a SaaS product your customers write in), it is a real one.

Two of the six can be closed in the configuration. TinyMCE 6.8.6 has the options but leaves them off; TinyMCE 7 turned them on by default:

tinymce.init({
    selector: "#editor",
    sandbox_iframes: true,       // CVE-2024-29203
    convert_unsafe_embeds: true  // CVE-2024-29881
});

TinyMCE 6.8.6 has no list of exceptions for the sandbox, so it applies to every iframe, YouTube and Vimeo embeds included. TinyMCE 7 and Editor42 leave the well-known video and media hosts out of it. The other four vulnerabilities have no option to turn on: they need a fix in the code.

Option 1: stay on TinyMCE 6.8.6

It costs nothing today, and the two options above are worth setting right away. But four vulnerabilities stay open, and anything found later stays open too. This is a stopgap for sites where every author is trusted, not a plan.

Option 2: upgrade to TinyMCE 7 or 8

This keeps you on Tiny's own, maintained line. The license is the GPL 2 or later, or a commercial license from Tiny. The GPL is a copyleft license, so check with your legal team whether its terms fit the way you ship your product; if they do not, the alternative is a paid license.

Both versions ask for a license key in the configuration: license_key: 'gpl' accepts the GPL terms, otherwise it is the key you buy. Without one, TinyMCE 7 only warns in the browser console, while TinyMCE 8 disables the editor and shows "The editor is disabled because a TinyMCE license key has not been provided."

Check that every plugin you use supports the version you upgrade to.

Option 3: move to Editor42

Editor42 is a fork of TinyMCE 6.8.6 under the MIT license. Its first release, 42.0.0, fixes all six vulnerabilities and turns the two options above on by default, with the same exceptions for video embeds as TinyMCE 7. Each fix is a separate commit you can read, listed on its security page.

Otherwise it is TinyMCE 6 under another name: the same API, the same configuration options and the same plugins. Usually the move is one script tag:

<script src="https://cdn.editor42.com/editor42/latest/editor42.min.js"></script>
<script>
    editor42.init({
        selector: "#editor"
        // the rest of your TinyMCE 6 configuration, unchanged
    });
</script>

Your existing tinymce.init() calls keep working too, because Editor42 also answers to window.tinymce. There is no license key and no account. Self-hosting, npm and the React, Vue, Angular, Svelte, jQuery and Web Component wrappers are covered in its migration guide.

TinyMCE 6 plugins install into editor42/plugins/ as they did into tinymce/plugins/: see the plugins for Editor42 in our catalog. A few plugins rely on TinyMCE's internal class names (tox-, mce-), which Editor42 renames; for those, its main build keeps the original names.

Option 4: switch to another editor

CKEditor 5 is maintained, and it too is licensed under the GPL or commercially. It needs a license key as well (licenseKey: 'GPL' or a bought one) and does not start without it. It is a different editor rather than a newer TinyMCE: your configuration and custom plugins have to be rewritten, and since CKEditor 5 keeps only the markup its features know, check how your existing content survives the move. Froala is commercial only.

Switching is the most work of the four, so it is worth it when you want that editor for its own sake, not as a way out of TinyMCE 6.

Side by side

Coming from TinyMCE 4, 5 or CKEditor 4

TinyMCE 4 and 5 have been without updates even longer, and their plugins do not run on TinyMCE 6. The step to TinyMCE 6 is the same whether you then stay on TinyMCE or take Editor42: our upgrade guide covers it.

The open-source CKEditor 4 ended with 4.22.1 in June 2023; later 4.x versions are paid long-term support. To move to a TinyMCE-compatible editor, follow how to migrate from CKEditor 4: the steps for TinyMCE 6 apply to Editor42 as they are.

Which one to choose

If the GPL works for you, or you are ready to pay for TinyMCE, upgrading keeps you on Tiny's maintained line. If you need to stay on MIT, or would rather not touch an integration that works, Editor42 gives you TinyMCE 6 with the known holes closed, for the price of a script tag. Staying on TinyMCE 6.8.6 as it is should only buy you time to do one of the two.

Editor42 is made by the team behind Pluginza.