Stored Cross-Site Scripting in SunEditor by JiHong88
CVE-2026-124492

8.3HIGH

Key Information:

Vendor

Jihong88

Status
Suneditor
Vendor
CVE Published:
8 November 2026

What is CVE-2026-124492?

SunEditor versions prior to 3.4.0 are susceptible to a stored cross-site scripting (XSS) vulnerability. This issue arises in the ModalAnchorEditor's #createBookmarkList function, which fails to properly escape the h1-h6 header textContent. Attackers can exploit this by storing HTML-encoded payloads in the editor headers. When a user accesses the link modal and inputs a '#' in the URL, the browser executes the injected JavaScript, potentially compromising user data and allowing for further attacks.

Affected Version(s)

suneditor 0 < 3.4.0

suneditor 3.4.0

References

https://github.com/JiHong88/suneditor/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/suneditor-before-3.4...
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

iElloc
.