CVE-2026-124492
Received Received - Intake

Stored XSS in SunEditor via ModalAnchorEditor Bookmark List

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124492
EUVD
EUVD-2026-119547

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jihong88 suneditor to 3.4.0 (exc)
suneditor suneditor to 3.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SunEditor before version 3.4.0 has a stored cross-site scripting (XSS) vulnerability in the ModalAnchorEditor's createBookmarkList function. It allows attackers to inject HTML-encoded JavaScript payloads into header textContent, which executes when a victim opens the link modal and types # in the URL input.

Detection Guidance

This vulnerability is specific to the SunEditor library and requires inspecting web applications using it. Check for SunEditor versions before 3.4.0 in your web application dependencies. Look for editor instances using ModalAnchorEditor with bookmark list functionality. Review any user-generated content in headers that could contain HTML payloads.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or redirect you to malicious sites. If you use SunEditor in a web application, your users' data and interactions could be compromised.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information to unauthorized parties, risking compliance.

Mitigation Strategies

Upgrade SunEditor to version 3.4.0 or later immediately. If upgrading is not possible, disable the ModalAnchorEditor's bookmark list feature or implement strict input validation and output encoding for header content. Review and sanitize all stored user-generated content in editor headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124492. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...