CVE-2026-110239: Rapyd Admin before 9.20.0 Stored XSS via rich-text Component

Q: What access does an attacker need to exploit this issue?

The attacker must be authenticated and able to set the bound property through the Livewire client API. Exploitation also depends on an administrator opening the affected record's form.

Q: Which users are at risk from the stored payload?

Administrators who open a form containing the affected record are the users whose browser can execute the stored JavaScript. The vulnerability affects the rich-text component when it renders bound model values as raw HTML.

Q: What version addresses the issue?

Upgrade Rapyd Admin to version 9.20.0 or later. Versions before 9.20.0 are affected.

Published Oct 13, 2026

Updated

Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.

Affected Software

1 affected component

Rapyd Rapyd Admin<9.20.0

Event History

Oct 13, 2026

CVE Published

via MITRE·06:50 PM

Data Sourced

via MITRE·06:50 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be authenticated and able to set the bound property through the Livewire client API. Exploitation also depends on an administrator opening the affected record's form.

Which users are at risk from the stored payload?

Administrators who open a form containing the affected record are the users whose browser can execute the stored JavaScript. The vulnerability affects the rich-text component when it renders bound model values as raw HTML.

What version addresses the issue?