EIP-2026-109087

This exploit demonstrates a stored XSS vulnerability in Leafpub 1.1.9 by injecting malicious JavaScript into the 'Custom Code' field via the settings API. The payload is executed when the settings page is viewed, confirming the vulnerability.