MEDIUM 5.3 NVD
CVE-2026-124491
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.
References
- https://github.com/JiHong88/suneditor/security/advisories/GHSA-2w4v-r3v4-f5h4
- https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-fileupload-plug
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.