Description
Summary
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external <script src=…> element bypasses the plugin’s sanitization logic.
Recommendation
Update the suneditor package to the latest compatible version. Followings are version details:
- Affected version(s): >= 3.0.0, <= 3.1.3
- Patched version(s): 3.1.4
References
Could your website be exposed too?
SmartScanner can check your website for SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed and gives you actionable findings to investigate.
Start a free scanRelated Issues
- SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
- i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes - CVE-2026-41692
- Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
- Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - marko - CVE-2026-41591
You might also like:
See something that needs correcting? Let us knowUpdated October 30, 2026