CVE-2026-54606
Received Received - Intake

Stored XSS in SunEditor via Embed Plugin

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid iframe, the plugin recreates a script element from the attacker-controlled src attribute and appends it to the live DOM, causing JavaScript execution in the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, an attacker who can submit embed HTML can trigger stored or reflected cross-site scripting when another user opens, previews, renders, or edits the content, enabling access to page data and account actions as the victim. This issue is fixed in version 3.1.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-54606
EUVD
EUVD-2026-66595

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
suneditor suneditor 3.1.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SunEditor is a JavaScript WYSIWYG editor. Prior to version 3.1.4, its Embed plugin had a flaw where it processed attacker-controlled HTML embed code. If an attacker included a script tag after a valid iframe, the plugin would recreate and execute the script in the editor's live DOM, leading to cross-site scripting (XSS).

Detection Guidance

This vulnerability can be detected by checking the version of SunEditor in use. If your application uses SunEditor version prior to 3.1.4, it is vulnerable. Inspect the application's dependencies or source code to verify the SunEditor version.

Impact Analysis

If you use SunEditor versions before 3.1.4, an attacker could inject malicious scripts into content you edit or view. This could allow them to steal your data, perform actions on your behalf, or take control of your session if the content is stored or reflected without proper backend sanitization.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance breaches if exploited.

Mitigation Strategies

Immediately upgrade SunEditor to version 3.1.4 or later. If upgrading is not possible, disable the Embed plugin or implement additional backend sanitization for user-provided HTML content to prevent script execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54606. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart