Skip to content
OpenAdvisories

Product · JiHong88

suneditor

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.6
    CVE-2026-124492

    SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List

    SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encod…

    JiHong88 suneditor
  • High 8.5
    CVE-2026-54606

    SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

    SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DO…

    JiHong88 suneditor suneditor npm