CVE-2026-54606

Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 3.1.4

Description A DOM-based Cross-Site Scripting (XSS) issue exists in the SunEditor Embed plugin within src/plugins/modal/embed.js. The plugin uses DOMParser to parse raw embed HTML and processes the resulting DOM nodes. If an external script element follows a valid iframe, the plugin recreates a script element using the attacker-controlled src attribute and appends it to the live DOM, leading to arbitrary JavaScript execution. If the application stores or reflects this content without backend sanitization, it can result in stored or reflected XSS when other users open, preview, render, or edit the content, potentially allowing unauthorized account actions or access to page data.

Recommendations Update SunEditor to version 3.1.4. As a temporary mitigation, restrict the use of the Embed plugin or ensure that all content processed by the editor is strictly sanitized on the backend before being stored or rendered.