SCEditor, a lightweight WYSIWYG editor, has an unchecked configuration option vulnerability that allows an attacker who can influence the options passed to sceditor.create() to inject arbitrary HTML or script via emoticon URLs. The lack of sanitisation means the injected content is rendered directly into the page, enabling a DOM‑based cross‑site scripting attack that can execute malicious JavaScript in the victim’s browser. This flaw is classified as a CWE‑79 injection issue and can lead to theft of session cookies, credential leakage, or arbitrary actions performed on behalf of the user.

Any deployment of SCEditor older than version 3.2.1 is susceptible, especially installations where configuration parameters such as emoticons, charset, or other settings can be modified by an attacker or derived from untrusted input. The flaw exists in all publicly released releases prior to the 3.2.1 update.

The vulnerability scores moderately (CVSS 5.4), and the EPSS indicates a very low probability of exploitation (<1%). It is not listed in the CISA KEV catalogue. Successful exploitation requires the attacker to have the ability to supply or alter the editor configuration; if such control is possible, they can trigger the XSS by embedding malicious script in a configuration value. Once triggered in the victim’s browser, the attacker can perform any action the page’s context allows.