CVE-2026-124494 SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean sanitizer's normalizeURL function decodes named entities like to an empty string. Attackers can inject href values such as javascript that pass the isSafeURL check but are decoded by browsers,...

CVE-2026-124494

The SunEditor text editor (versions before 3.4.0 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause lies in the html.clean() sanitizer's _normalizeURL() function, which incorrectly decodes named entities such as : into an empty string. This allows attackers to injec...

CVE-2026-124494 SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean sanitizer's normalizeURL function decodes named entities like to an empty string. Attackers can inject href values such as javascript that pass the isSafeURL check but are decoded by browsers,...

CVE-2026-124494 SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean sanitizer's normalizeURL function decodes named entities like to an empty string. Attackers can inject href values such as javascript that pass the isSafeURL check but are decoded by browsers,...

PT-2026-140007

Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 3.4.0 Description Stored cross-site scripting occurs because the normalizeURL function within the html.clean sanitizer incorrectly decodes named entities, such as , to an empty string. This allows attackers to bypas...

CVE-2026-5160

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

CVE-2019-20041: Improper Input Validation

wpksesbadprotocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript substring...