Dashboard / CVE-2026-124422

CVE-2026-124422

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2026-11-08 Modified: 2026-11-12 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: Low
VI: Low
VA: None

Description

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
jihong88 suneditor 3.0.0 < 3.4.0
jihong88 suneditor 3.0.0 < 3.4.0

References & Advisories (5)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.24%
Raw Score 0.002380
Percentile 14.9%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00238
2026-11-12
0.00238
2026-11-10
0.00238
2026-11-09
0.00238
2026-11-08
0.00238

Intelligence Sources

mitre ref →
nvd ref →

External Links