A critical stored cross-site scripting flaw has been disclosed in SunEditor, a widely used open-source rich-text editor for the web. The vulnerability, tracked as CVE-2026-124493, carries a CVSS score of 9.3 and affects every version before 3.4.0. It was published on 8 November 2026, and version 3.4.0 fixes it.

SunEditor is a JavaScript WYSIWYG editor that website owners embed so visitors and staff can format text without writing HTML. It appears in content management systems, forums, comment forms and admin panels, anywhere users are expected to produce formatted content. That reach is what makes a stored scripting flaw in the editor serious: malicious content saved once can run later in the browsers of other people who open it.

The flaw sits in the editor's DocumentType constructor. According to the CVE record published by the US National Vulnerability Database, the constructor takes header text content and injects it into innerHTML without HTML escaping. An attacker can store entity-encoded HTML in heading elements, from h1 to h6, and that code executes as JavaScript when an editor using document header mode initialises. Because the payload is stored in the content itself, it does not need the victim to click a crafted link or visit a malicious page. Opening the affected document in the editor is enough.

The practical consequence is session theft. JavaScript running in an editor session can read session cookies and other data available to the page, and can act with the victim's permissions. On a site where editors, moderators or administrators review user-submitted content, a single stored payload could therefore compromise a privileged account, and from there the wider site. The weakness is classified as CWE-79, improper neutralisation of input during web page generation, the standard category for cross-site scripting.

The CVE record states that SunEditor versions before 3.4.0 are affected and that 3.4.0 is unaffected. The flaw was published to the CVE List and the National Vulnerability Database on 8 November 2026, with the advisory reference GHSA-h9pq-57qf-vvfh. The National Vulnerability Database has not yet published its own assessment, and the 9.3 score comes from the CVE record's scoring. No exploitation in the wild has been reported, and the flaw is not listed in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue.

The same disclosure batch includes a second stored cross-site scripting flaw in SunEditor, CVE-2026-124492, which affects the link modal bookmark list. That flaw, scored 8.3, inserts entity-decoded heading text into the bookmark list without escaping, and its payload runs when a victim opens the link modal and types a hash character in the URL input. The two flaws share a root cause, unescaped heading text reaching innerHTML, and both are fixed in the 3.4.0 release.

Website owners using SunEditor should upgrade to version 3.4.0 as soon as possible. Because the flaw is stored, upgrading the editor code is only part of the response. Content already saved in a database or content store should be reviewed, since a payload planted before the upgrade could still be sitting in an existing document waiting to be opened. Sites that let untrusted users submit formatted content should treat any stored headings with particular suspicion until that review is done.

Administrators should also check where SunEditor is deployed. The editor is often pulled in as a dependency of another package or bundled into a content management system, so it may be present in places the site owner has not thought about. Checking the installed version across every application, rather than only the main site, is the reliable way to confirm the exposure is closed.

Stored cross-site scripting remains one of the most common and most damaging web flaws, precisely because it turns a site's own content against its users. The SunEditor case is a reminder that the risk does not only sit in a site's own code. A vulnerability in a shared component, an editor, a plugin or a library, reaches every site that embeds it, and the fix arrives as a version number that someone still has to apply.