CVE-2026-124491

SunEditor versions prior to 3.4.0 are susceptible to a stored cross-site scripting (XSS) vulnerability within the FileUpload plugin 's create() method. The root cause is the assignment of server-returned file names to innerHTML without proper escaping. Attackers can upload files with malicious, H...

Vanilla: FileUpload Plugin: CSRF (delete all attached files)

Description ------------ The current version 1.9.1 of the official FileUpload plugin is vulnerable to CSRF. A successful attack allows the removal of files the attacked user has the permission to delete. Administrators for example have the permission to delete all attached files. As the request t...