PT-2026-140007

Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 3.4.0 Description Stored cross-site scripting occurs because the normalizeURL function within the html.clean sanitizer incorrectly decodes named entities, such as , to an empty string. This allows attackers to bypas...