CVE-2026-110239EPSS p13.5%

CVE-2026-110239CVE-2026-110239

Description

Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.

Scoring

CVSS 4.4 ()
VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS0.24% probability of exploitation · percentile 13.5% · 2026-10-17T12:00:28Z
Last modified2026-10-14
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.