CVE-2026-124493

SunEditor versions prior to 3.4.0 are vulnerable to a stored cross-site scripting (XSS) flaw within the DocumentType constructor . The root cause is the injection of header textContent into innerHTML without proper HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers, which exe...