Medium severity · published Oct 13, 2026
CVE-2026-110239
Rapyd Admin before 9.20.0 Stored XSS via rich-text Component
4.4
CVSS
0.2%
EPSS
No
On KEV
Description
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
rapyd-admin · zofe
0.4.0; 0.8.5 through 0.12.17; 1.0.0; 1.1.0 through 1.1.8; 9.0.0 before 9.20.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110239
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110239
patch
https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a
release-notes
https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0
technical-description
https://github.com/zofe/rapyd-admin/blob/v9.19.0/resources/views/components/rich-text.blade.php#L50-L61
technical-description
https://github.com/zofe/rapyd-admin/blob/v9.19.0/src/helpers.php#L11-L29
product
https://github.com/zofe/rapyd-admin
third-party-advisory
https://www.vulncheck.com/advisories/rapyd-admin-before-9.20.0-stored-xss-via-rich-text-component
More from rapyd-admin
9.8
CVE-2026-109566
Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder
8.8
CVE-2026-110238
Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component
7.2
CVE-2026-109567
Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component
6.1
CVE-2026-109565
Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component