{"id":"CVE-2026-124493","published":"2026-11-08T14:18:19.130","lastModified":"2026-11-08T14:18:19.130","description":"SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-h9pq-57qf-vvfh","tags":[]},{"url":"https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-documenttype-header-textcontent","tags":[]}],"exploitRefs":[{"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-h9pq-57qf-vvfh","tags":[]}],"hasPoc":true,"ai":null}