The SunEditor editor, versions 3.0.0 through 3.3.x, contains a stored cross‑site scripting flaw in the html.clean() routine. The vulnerability arises when the editor rebuilds iframe elements from a JSON blob of attributes without filtering the srcdoc value or uppercase SRC keys. An attacker can inject crafted HTML through paste, html.set, or html.insert, causing script execution in the host page when a victim later loads or pastes the content.

Affected systems are all installations of SunEditor from version 3.0.0 up to, but not including, 3.4.0. The problem exists in the product released by the project maintainer jihong88.

The flaw has a CVSS score of 5.3, indicating moderate risk, and is not listed in the CISA KEV catalog. An EPSS score is not available, so the probability of exploitation cannot be quantified. The known attack surface relies on a user exposing malicious content to the editor; when another user loads the same content a script runs with the page's origin. While the vulnerability is limited to scenarios where the editor is used for content input, it remains a serious risk because it can compromise user data and session integrity. Prompt remediation is advised.