CVE-2026-124491
SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename
CVSS Score
6.4
EPSS Score
0.0%
EPSS Percentile
0th
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.
| CWE | CWE-79 |
| Vendor | jihong88 |
| Product | suneditor |
| Published | Nov 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for jihong88 suneditor
Be the first to know when new medium vulnerabilities affecting jihong88 suneditor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
JiHong88 / suneditor
0 < 3.4.0
References
Credits
iElloc