Skip to content
OpenAdvisories

Package · npm

sceditor

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Medium 5.4
    CVE-2026-25581

    SCEditor affected by DOM XSS via emoticon URL/HTML injection

    SCEditor is a lightweight WYSIWYG BBCode and XHTML editor. Prior to 3.2.1, if an attacker has the ability control configuration options passed to sceditor.create(), like emoticons, charset, etc. then it's possible for them to trigger an XSS attack due to lack…

    samclarke SCEditor sceditor npm