CVE-2026-110239
Awaiting Analysis
Awaiting Analysis - Queue
Stored XSS in Rapyd Admin via Unsanitized Rich-Text Component
Vulnerability report for CVE-2026-110239, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-13
Last updated on: 2026-10-13
Assigner: VulnCheck
Description
Description
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zofe | rapyd-admin | 0.4.0 |
| zofe | rapyd-admin | 0.8.5 |
| zofe | rapyd-admin | 1.0.0 |
| zofe | rapyd-admin | 1.1.0 |
| zofe | rapyd-admin | 9.0.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
