SunEditor (< 3.4.0)

SunEditor versions prior to 3.4.0 contain a stored cross-site scripting vulnerability in the ModalAnchorEditor component that allows execution of arbitrary JavaScript via unsanitized header content.