SunEditor Embed Plugin DOM-based Cross-Site Scripting (XSS) – CVE-2026-54606 (High) -DC-Aug2026-1961

Listen to this Post

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SunEditor Embed plugin (CVE-2026-54606). The plugin parses user‑supplied embed HTML using `DOMParser` and processes the resulting DOM nodes. When a crafted payload containing a valid `