CVE-2026-124491

Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 3.4.0

Description A stored cross-site scripting issue exists in the FileUpload plugin create() method. The application assigns server-returned file names to innerHTML without proper escaping. This allows attackers to upload files with names containing HTML that bypasses html.clean(), leading to JavaScript execution in the browsers of users who load the content or gallery items, which can result in session theft.

Recommendations Update to version 3.4.0 or later. As a temporary mitigation, restrict the use of the FileUpload plugin until the update is applied.