NPM: SunEditor: Critical XSS vulnerability - sanitizer bypass

sanitizer bypass vulnerability discovered by ? in WordPress Npm suneditor versions = 2.47.10...

SunEditor: Critical XSS vulnerability - sanitizer bypass

Summary SUNEDITOR v2.47.10 appears to allow JavaScript execution through crafted namespaced HTML elements. The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that execute...

EUVD-2026-85324

SunEditor: Critical XSS vulnerability - sanitizer bypass...

CVE-2026-59167

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an applicati...

CVE-2026-59167

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an applicati...

CVE-2026-59167 SunEditor: Critical XSS vulnerability - sanitizer bypass

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an applicati...

CVE-2026-54606

creationtimestamp| type| source ---|---|--- 2026-08-26 16:35:08+00:00| published-proof-of-concept| https://github.com/JiHong88/suneditor/security/advisories/GHSA-w93q-cq9w-58p7...

CVE-2026-54606

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

GHSA-W93Q-CQ9W-58P7 SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

Summary A DOM-based Cross-Site Scripting XSS vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing...

NPM: SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

NPM: SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed vulnerability discovered by ? in WordPress Npm suneditor versions = 3.1.3...

SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

Summary A DOM-based Cross-Site Scripting XSS vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing...

CVE-2026-54606

SunEditor (lightweight WYSIWYG JavaScript editor) is vulnerable to DOM-based cross-site scripting in its Embed plugin (src/plugins/modal/embed.js). Prior to version 3.1.4 , the plugin parses attacker-controlled raw embed HTML using DOMParser; when an external [removed] element follows a valid , i...

CVE-2026-54606 SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

CVE-2026-54606 SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

CVE-2026-54606 SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

EUVD-2026-66595

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

PT-2026-82210

Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 3.1.4 Description A DOM-based Cross-Site Scripting XSS issue exists in the SunEditor Embed plugin within src/plugins/modal/embed.js. The plugin uses DOMParser to parse raw embed HTML and processes the resulting DOM...