CVE-2026-88976

Plate (a rich-text editor with AI and shadcn/ui support) is vulnerable to a stored cross-site scripting (XSS) issue in its core HTML deserialization APIs. Prior to 53.3.11 , and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, supplied HTML strings are parsed in the active document...