Stored XSS Vulnerability in SunEditor by JiHong88
CVE-2026-124493

9.3CRITICAL

Key Information:

Vendor

Jihong88

Status
Suneditor
Vendor
CVE Published:
8 November 2026

What is CVE-2026-124493?

SunEditor prior to version 3.4.0 is vulnerable to a stored cross-site scripting (XSS) attack. The vulnerability resides in the DocumentType constructor, which allows for the injection of entity-encoded HTML into header elements (h1-h6) without proper HTML escaping. This results in the execution of harmful JavaScript when the editor initializes in document:header mode, posing a risk of session cookie theft for unsuspecting users.

Affected Version(s)

suneditor 0 < 3.4.0

suneditor 3.4.0

References

https://github.com/JiHong88/suneditor/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/suneditor-before-3.4...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

iElloc
.