CRITICAL 9.3 NVD
CVE-2026-124493
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML witho
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.
References
- https://github.com/JiHong88/suneditor/security/advisories/GHSA-h9pq-57qf-vvfh
- https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-documenttype-he
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-11-08 via NVD.
Risk Timeline
CVE Disclosed2026-11-08 · -1 days ago
Remediation Resources
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.