CVE-2026-25581: SCEditor affected by DOM XSS via emoticon URL/HTML injection

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-06 · updated 2026-06-17
Weakness: CWE-79

Description

SCEditor is a lightweight WYSIWYG BBCode and XHTML editor. Prior to 3.2.1, if an attacker has the ability control configuration options passed to sceditor.create(), like emoticons, charset, etc. then it's possible for them to trigger an XSS attack due to lack of sanitisation of configuration options. This vulnerability is fixed in 3.2.1.

Affected products

samclarke SCEditor: before 3.2.1 — fixed in 3.2.1

How to fix

Upgrade to a fixed version: samclarke SCEditor 3.2.1. Check the vendor advisory for mitigations.

References

https://github.com/samclarke/SCEditor/commit/5733aed4f0e257cb78e1ba191715fc458cbd473d
https://github.com/samclarke/SCEditor/security/advisories/GHSA-25fq-6qgg-qpj8

Get alerted when CVE-2026-25581 or the next vulnerability affects your stack