CVE-2026-124491
MEDIUM
NVD
CVSS Score
6.4
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.