On the TinyMCE website, they recommend filtering HTML input with tools such as HTMLPurifier to prevent XSS vulnerabilities: http://www.tinymce.com/wiki.php/FAQ