Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: JiHong88 Clear all filters
TI-2026-86759 CVE-2026-124422 · GHSA-fvm2-c629-pcjf

Stored cross-site scripting in SunEditor via html.clean()

Priority LOW 24

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00238 Published 2026-11-08 Fixed in 3.4.0 CWE-79
TI-2026-42328 CVE-2026-59167 · GHSA-6rf4-v2fh-m6p4

SunEditor: Critical XSS vulnerability - sanitizer bypass

Priority HIGH 82

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00499 Published 2026-09-23 Fixed in 2.47.11 CWE-79