POEditor — Vulnerabilities & Security Advisories 3

POEditor is a cloud-based localization platform enabling teams to manage translations and software localization workflows. Historically, the platform has been susceptible to cross-site scripting (XSS) vulnerabilities, allowing attackers to inject malicious scripts into web pages viewed by users. Additionally, remote code execution (RCE) flaws have been identified in certain versions, potentially enabling unauthorized system access. While no major public security incidents have been widely reported, the three CVEs on record highlight consistent risks in input validation and access control. The platform's web interface and API endpoints remain primary attack surfaces, with privilege escalation vulnerabilities occasionally discovered in administrative functions.