What’s Vulnerable › Vulnerabilities

CVE-2026-110239: Rapyd Admin before 9.20.0 Stored XSS via rich-text Component

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-14
• Weakness: CWE-79

Description

Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.

Affected products

• zofe rapyd-admin: from 0.8.5 through 0.12.17; from 1.1.0 through 1.1.8; from 9.0.0 before 9.20.0; 0.4.0, 1.0.0 — fixed in 9.20.0

How to fix

Upgrade to a fixed version: zofe rapyd-admin 9.20.0. Check the vendor advisory for mitigations.

References

• https://github.com/zofe/rapyd-admin
• https://github.com/zofe/rapyd-admin/blob/v9.19.0/resources/views/components/rich-text.blade.php#L50-L61
• https://github.com/zofe/rapyd-admin/blob/v9.19.0/src/helpers.php#L11-L29
• https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a
• https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0
• https://www.vulncheck.com/advisories/rapyd-admin-before-9.20.0-stored-xss-via-rich-text-component

Get alerted when CVE-2026-110239 or the next vulnerability affects your stack