Skip to content
OpenAdvisories

Product · JiHong88

suneditor

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-124493

    SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent

    SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript…

    JiHong88 suneditor
  • Critical 9.3
    CVE-2026-124494

    SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass

    SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that p…

    JiHong88 suneditor
  • Critical 10.0
    CVE-2026-59167

    SunEditor: Critical XSS vulnerability - sanitizer bypass

    SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain …

    JiHong88 suneditor suneditor npm