Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck
CVE-2026-110239Rapyd Admin before 9.20.0 Stored XSS via rich-text Component
Medium 4.4
In plain English
A medium-severity cross-site scripting in rapyd-admin from zofe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.2%top 85.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zofe | rapyd-admin | 0.4.00.8.5 – through 0.12.171.0.01.1.0 – through 1.1.89.0.0 – before 9.20.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- Patch Commit patch
- rapyd-admin v9.20.0 Release Notes release-notes
- Vulnerable code in rich-text.blade.php technical-description
- dot_to_property helper in helpers.php technical-description
- https://github.com/zofe/rapyd-admin product
- VulnCheck Advisory: Rapyd Admin before 9.20.0 Stored XSS via rich-text Component third-party-advisory