CVE-2026-25581

Published: Feb 6, 2026Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: security-advisories@github.com (Secondary)

Description

SCEditor is a lightweight WYSIWYG BBCode and XHTML editor. Prior to 3.2.1, if an attacker has the ability control configuration options passed to sceditor.create(), like emoticons, charset, etc. then it's possible for them to trigger an XSS attack due to lack of sanitisation of configuration options. This vulnerability is fixed in 3.2.1.

Affected (1)

Products: Sceditor: Sceditor

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sceditor Sceditor	Before 3.2.1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/samclarke/SCEditor/commit/5733aed4f0e257cb78e1ba191715fc458cbd473d

Source: security-advisories@github.com

Patch

https://github.com/samclarke/SCEditor/security/advisories/GHSA-25fq-6qgg-qpj8

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.