Skip to content
OpenAdvisories

Product · JiHong88

suneditor

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-124491

    SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename

    SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean…

    JiHong88 suneditor
  • Medium 6.1
    CVE-2026-124422

    SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder

    SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste,…

    JiHong88 suneditor