Loading story…
A high-severity cross-site scripting flaw, tracked as CVE-2026-55596, was disclosed in the udecode Plate rich-text editor after researchers found that the @platejs/media component trusted serialized provider and sourceUrl metadata when rendering embedded media. In affected versions 53.0.0 through before 53.1.4, an attacker with the ability to craft a Plate document could mark content as a known video provider while supplying a javascript: iframe source, causing unsafe content to be rendered when a victim opened the document. The issue is classified as CWE-79 and carries a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.
Plate maintainers fixed the bug in version 53.1.4 by removing the code path that trusted serialized media metadata and instead deriving embed state from the parsed render URL. The patch was merged through pull request #5014 and corresponding commit 6214914ca811adf22d0ad503154494216eed68ba, with regression tests added to ensure unsafe serialized metadata no longer produces embeds and that provider information is recalculated from the actual URL. Organizations using Plate media embeds should upgrade to 53.1.4 or later to prevent malicious documents from triggering iframe-based script execution.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
NVD metadata for CVE-2026-55596 was updated and the vulnerability analysis was finalized. This followed the public disclosure and advisory publication for the Plate media embed XSS flaw.
A public advisory described CVE-2026-55596, a cross-site scripting vulnerability in Plate versions 53.0.0 through before 53.1.4 that let crafted documents bypass URL sanitization and execute javascript: iframe sources. The advisory also referenced the fix, pull request, commit, and release materials.
Plate released version 53.1.4 to address the media embed rendering issue, rejecting unsafe serialized iframe URLs. The release notes tied the fix to pull request #5014 and identified it as a security-related update for @platejs/media.
The Plate project merged pull request #5014, a security bugfix for the media plugin that derives embed metadata from the render URL instead of trusting serialized provider metadata. The PR explicitly addressed unsafe handling of javascript: URLs in media embed flows.
A security bug fix was committed to the udecode Plate project to stop serialized media metadata from bypassing URL parsing and allowing unsafe iframe render URLs. The change removed trust in serialized provider/sourceUrl metadata and added regression tests for the advisory proof of concept.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TinyMCE has patched multiple cross-site scripting vulnerabilities in its widely deployed rich text editor, including stored and sanitization-related flaws tracked as `CVE-2026-47759`, `CVE-2026-47760`, `CVE-2026-47761`, and `CVE-2026-47762`. The issues could let remote attackers inject malicious JavaScript into web content and compromise active user sessions when affected content is viewed. Reported weaknesses include improper namespace scope handling in the core sanitizer, bypasses involving prefixed attributes and comment handling, and a flaw in the media plugin. The media plugin issue, `CVE-2026-47761`, stems from TinyMCE serializing rich-media elements into placeholder images while preserving raw properties in `data-mce-*` HTML attributes. Because many downstream filters permit arbitrary `data-*` attributes, malicious payloads can survive sanitization, be stored persistently, and later be deserialized into active DOM elements without sufficient validation, triggering script execution in users' browsers. TinyMCE said fixes are available in supported branches and advised customers to upgrade to version `7.9.3` or later or `8.5.1`, while version 5 commercial users may require long-term support updates.
Jun 29, 2026
A vulnerability tracked as **CVE-2026-44990** allows stored cross-site scripting in `sanitize-html` when applications use the library’s default configuration and later render sanitized user content as trusted HTML. The flaw affects versions prior to **2.17.4** and stems from the handling of the disallowed `xmp` element: because `htmlparser2` treats `xmp` as a raw-text tag, attacker-supplied markup inside it is preserved as text during sanitization but can be emitted back as active HTML or JavaScript under the default `disallowedTagsMode: 'discard'` behavior. GitHub’s advisory and the upstream patch say the bypass can let payloads such as `<script>`, `img` event handlers, and `svg`-embedded script content survive filtering and execute in a victim’s browser. The fix in **2.17.4** adds `xmp` to `nonTextTags` so content inside a disallowed `xmp` tag is dropped instead of re-emitted, and regression tests were added to confirm the malicious content is removed. The issue was reported by **Vincenzo Turturro** (`sushi-gif`), and users of affected `sanitize-html` deployments, including those in **ApostropheCMS**, were urged to update immediately.
Jun 29, 2026
OpenReplay fixed a critical stored cross-site scripting flaw, tracked as **`CVE-2026-55879`**, that affects versions **`1.24.0` before `1.25.0`** and can let an unauthenticated attacker take over dashboard accounts. The issue allows anyone with a public project key to submit malicious custom event names or page URLs that are stored by the platform and later rendered in the authenticated dashboard, where attacker-controlled JavaScript can execute in the dashboard origin, steal the session JWT from `localStorage`, and hijack user access. The vulnerability is rated **CVSS 9.3** and mapped to **`CWE-79`**. The remediation shipped in **OpenReplay `v1.25.0`** and was reflected in subsequent code changes that centralized output encoding for event read paths. The patch escapes event entries and nested property maps on the backend before returning data from `SearchEvents` and `GetEventByID`, and also hardens the frontend by escaping JSON shown in `EventDetailsModal`, replacing `innerHTML` with `textContent` in a text measurement helper, and adding a reusable HTML-escaping utility. Together, the changes indicate the flaw stemmed from unsanitized event content being inserted into the UI without proper output encoding.
Jul 11, 2026