The vulnerability in udecode plate affects versions from 53.0.0 up to but not including 53.1.4. The media embed renderer component improperly trusts serialized metadata for media providers or source URLs in the useMediaState hook, skipping protocol validation on URLs. This allows an attacker to craft a Plate document that specifies a known video provider but uses a javascript: URL as the iframe source. When rendered, the MediaEmbedElement inserts this iframe src directly, enabling cross-site scripting attacks. The vulnerability is identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). No official remediation level or patch link is provided, but the issue is fixed in version 53.1.4.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when they open a maliciously crafted Plate document. This can lead to full compromise of confidentiality and integrity of the user's session and data (CVSS impact: High for confidentiality and integrity, none for availability). The attack requires user interaction (opening the document) and low privileges (PR:L).

Upgrade to udecode plate version 53.1.4 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, users should verify the version upgrade. There is no indication that temporary mitigations or workarounds exist. Patch status is not explicitly confirmed beyond the version fix; check vendor sources for current remediation guidance.