CVE-2026-124422

MEDIUM 6.1

SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.

CWE	CWE-79
Vendor	jihong88
Product	suneditor
Published	Nov 8, 2026

Stay Ahead of the Next One

Get instant alerts for jihong88 suneditor

Be the first to know when new medium vulnerabilities affecting jihong88 suneditor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

jihong88 / suneditor

3.0.0 < 3.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/JiHong88/suneditor/security/advisories/GHSA-q867-q2hw-f8gp github.com: https://github.com/JiHong88/suneditor/commit/57db24ac218cd10942fed0bb8288e9cb40b334bb github.com: https://github.com/JiHong88/suneditor/releases/tag/3.4.0 github.com: https://github.com/JiHong88/suneditor/blob/3.3.3/src/core/logic/dom/html.js#L336-L350 vulncheck.com: https://www.vulncheck.com/advisories/suneditor-3.0.0-before-3.4.0-stored-xss-via-html-clean-iframe-placeholder

Credits

kemrec manus-pi EclipsSec Zachariah Mithani (AploSec)