Quick answers
- Is CVE-2026-102918 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-102918 being exploited in the wild.
- How severe is CVE-2026-102918?
- Medium severity, with a CVSS score of 6.4, published 30 October 2026.
- Which products and versions are affected?
- Redux Framework up to and including 4.5.15.
- Is there a fix for CVE-2026-102918?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-102918 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-102918?
- Check whether you run Redux Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stored XSS in the multi_media field renderer, which outputs user-supplied data into href attributes, hidden input values, and HTML elements without proper escaping, while neighboring attributes use esc_attr(). Combined with a permissions bypass in Redux_Extension_Users::user_meta_save() that validates against a 'checkuser_id' from the request body rather than the current user, a Subscriber can write fields declared for 'manage_options'. Exploitation requires a theme or plugin registering a multi_media field via the Redux Users API, and stored scripts execute when an administrator views the attacker's profile.
Affected products
- Redux Redux Framework up to and including 4.5.15
Timeline
- 2026-10-30: advisory