CVE-2026-55596

highCVSS 8.7covered by 1 sourcefirst seen 2026-07-08

Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as a javascript: iframe source that the registry MediaEmbedElement renders directly as an iframe src when a victim opens the document. This issue is fixed in version 53.1.4.

⚡ Watch CVE-2026-55596

Get an email if CVE-2026-55596 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-55596: Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed r…nvd · 2026-07-08

External references

NVD record for CVE-2026-55596

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-55596 status](https://www.csirts.com/badge/CVE-2026-55596)](https://www.csirts.com/cve/CVE-2026-55596)