Stored Cross-Site Scripting Vulnerability in Rapyd Admin by Zofe

CVE-2026-110239

What is CVE-2026-110239?

Rapyd Admin prior to version 9.20.0 is susceptible to a stored cross-site scripting (XSS) vulnerability within the x-rpd::rich-text Blade component. This issue arises from the improper handling of bound model values, which are output as raw HTML without adequate sanitization. As a result, authenticated users can exploit the Livewire client API to inject JavaScript. This malicious code is triggered when administrators interact with the affected record's form, potentially compromising the application's security and facilitating unauthorized actions.

References