Package Instance

SCEditor has DOM XSS via emoticon URL/HTML injection
If an attacker has the ability control configuration options passed to `sceditor.create()`, like `emoticons`, `charset`, etc. then it's possible for them to trigger an XSS attack due to lack of sanitisation of configuration options.

Proof of concept:

```js
sceditor.create(textarea, {
emoticons: {
dropdown: { ':)': { url: 'x" onerror="window.__xss = true' } }
}
});
```