Rapyd Admin versions 9.4.0 through 9.19.9 contain a stored cross‑site scripting flaw. The select‑list component fails to escape user‑supplied display names when they are stored and later rendered in the Activity log Author filter. An attacker who is not authenticated can create a user account with a malicious HTML or JavaScript name. When an administrator views the log, the unescaped content runs inside the admin’s browser context, allowing execution of arbitrary scripts, defacement or credential theft.

Affected versions are Rapyd Admin v9.4.0 up to but not including v9.20.0 from the vendor zofe. The vulnerability has been patched in release v9.20.0, as noted in the official release notes and commit history. Administrators using any version in the range must check their installed tenant versions and perform the upgrade.

The CVSS score of 5.3 indicates moderate severity, corresponding to moderate impact if exploitation succeeds. Since the EPSS score is not available, the likelihood of exploitation cannot be precisely quantified, but the flaw is visible and an attacker can easily register and inject code without any prior access. The vulnerability is not yet listed in the CISA KEV catalog, but administrators should treat it as critical until a patch is applied. Exploitation requires only a benign registration and occurs when an admin subsequently views the log.