CVE-2026-110239

MEDIUM 4.4

Rapyd Admin before 9.20.0 Stored XSS via rich-text Component

CVSS Score

4.4

EPSS Score

0.0%

EPSS Percentile

0th

Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.

CWE	CWE-79
Vendor	zofe
Product	rapyd-admin
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for zofe rapyd-admin

Be the first to know when new medium vulnerabilities affecting zofe rapyd-admin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

zofe / rapyd-admin

0.4.0 0.8.5 ≤ 0.12.17 1.0.0 1.1.0 ≤ 1.1.8 9.0.0 < 9.20.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a github.com: https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0 github.com: https://github.com/zofe/rapyd-admin/blob/v9.19.0/resources/views/components/rich-text.blade.php#L50-L61 github.com: https://github.com/zofe/rapyd-admin/blob/v9.19.0/src/helpers.php#L11-L29 github.com: https://github.com/zofe/rapyd-admin vulncheck.com: https://www.vulncheck.com/advisories/rapyd-admin-before-9.20.0-stored-xss-via-rich-text-component

Credits

hyderpwn