Known vulnerabilities in davidanderson Redux Framework
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-104812 | Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key | 6.4 Medium | Nov 5, 2026 |
| CVE-2026-120533 | Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile | 6.4 Medium | Nov 5, 2026 |
| CVE-2026-103997 | The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,… | 6.5 Medium | Oct 31, 2026 |
| CVE-2026-102918 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and… | 6.4 Medium | Oct 30, 2026 |
| CVE-2025-14123 | The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including,… | 6.8 Medium | Oct 9, 2026 |
| CVE-2026-90992 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via… | 6.4 Medium | Oct 1, 2026 |
| CVE-2026-88999 | The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,… | 4.3 Medium | Oct 1, 2026 |
| CVE-2026-5410 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in… | 6.4 Medium | Sep 19, 2026 |
| CVE-2026-5400 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter… | 6.4 Medium | Sep 19, 2026 |
| CVE-2026-5399 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User… | 6.4 Medium | Sep 10, 2026 |
| CVE-2025-9488 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data’ parameter in all… | 6.4 Medium | Dec 13, 2025 |
| CVE-2024-6828 | The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization… | 7.2 High | Jul 23, 2024 |
Other davidanderson products
UpdraftPlus: WP Backup & Migration Plugin 4
Internal Link Juicer: SEO Auto Linker for WordPress 3
All-In-One Security (AIOS) – Security and Firewall 2
WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance 2
Easy Updates Manager 1
European VAT Compliance Assistant for WooCommerce 1
Testimonial Slider 1
UpdraftPlus: WordPress Backup & Migration Plugin 1
WPGet API – Connect to any external REST API 1