NPM: SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

NPM: SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed vulnerability discovered by ? in WordPress Npm suneditor versions = 3.1.3...

EUVD-2026-66595

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

CVE-2025-22545

CVE-2025-22545: The iframe-to-embed vulnerability (sw-galati.ro iframe) allows Stored XSS when embedding the iframe. Affected: iframe-to-embed. Root cause: improper input neutralization during web page generation. Impact per provided metrics is Low in confidentiality, integrity, availability with...

WordPress iframe to embed plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin iframe to embed versions = 1.2...

PT-2025-4536 · Unknown · Sw-Galati.Ro

Name of the Vulnerable Software and Affected Versions: sw-galati.ro iframe to embed versions n/a through 1.2 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS in the iframe to embed...