EUVD-2026-119376

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute...

CVE-2026-124422

SunEditor versions 3.0.0 before 3.4.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the html.clean() function. The root cause is the failure to filter srcdoc or uppercase SRC keys when rebuilding iframes from the data-se-iframe-holder-attrs JSON. Attackers can inject ...

PT-2026-139898

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute...

CVE-2026-124422: jihong88 suneditor: SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds…

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute...