SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed
Summary A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed HTML followed by an external element bypasses the plugin’s sanitization logic. The plugin recreates and appends the attacker-controlled script element to the live DOM, causing JavaScript execution in the context of the editor page. If an application stores or reflects SunEditor content without additional backend sanitization, this can lead to stored or reflected XSS …