Cross-Site Scripting Vulnerability in SunEditor WYSIWYG Editor

CVE-2026-54606

What is CVE-2026-54606?

The SunEditor Embed plugin prior to version 3.1.4 is vulnerable to Cross-Site Scripting (XSS) due to improper handling of user-controlled embed HTML. When processing the raw HTML, the plugin can inadvertently append a malicious script element to the DOM if it follows a legitimate iframe. This could allow attackers to execute JavaScript within the context of the editor, potentially compromising user data and account actions when the content is edited or viewed by other users. Applications using this plugin without appropriate backend sanitization mechanisms are particularly at risk. The vulnerability is addressed in version 3.1.4.

References