CVE-2026-124493
SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.
| CWE | CWE-79 |
| Vendor | jihong88 |
| Product | suneditor |
| Published | Nov 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for jihong88 suneditor
Be the first to know when new unknown vulnerabilities affecting jihong88 suneditor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
JiHong88 / suneditor
0 < 3.4.0
References
Credits
iElloc