Three cross-site scripting vulnerabilities have been identified in Readwise Reader for Android version 8.7.2. Attackers can exploit these flaws by creating malicious documents or metadata. Successful exploitation allows arbitrary JavaScript execution within the application's WebView. This could lead to the compromise of user data, including documents, credentials, and session tokens. CVE-2026-18311 affects header rendering due to insufficient HTML escaping of metadata fields like author and title. CVE-2026-18312 impacts WebView URL construction for X videos and iOS paywall messages due to improper URL metadata escaping. CVE-2026-18320 stems from a wildcard attribute rule in the article body sanitization allowing malicious SVG markup. These vulnerabilities enable stored XSS when documents are synchronized to Android devices. While the vendor has not been reachable, version 8.10.1 reportedly patches the sanitizer-wildcard issue. Users are advised to update the app and exercise caution with untrusted content.