6.4
Medium
CVE-2026-5400 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter…
Description
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Redux Framework 4.5 | earliest → 4.5.13 | No fix stated |
Other CVEs of Redux Framework
The 12 CVEs of Redux Framework →
CVE-2026-104812
Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key
6.4
Medium
CVE-2026-120533
Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile
6.4
Medium
CVE-2026-103997
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,…
6.5
Medium
CVE-2026-102918
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and…
6.4
Medium