Executive brief
Redux Framework is a popular WordPress plugin that manages theme and plugin settings. A stored cross-site scripting (XSS) vulnerability in the Slider field of user profiles allows low-privileged users (Subscriber level and above) to inject malicious scripts that execute when administrators view their profile, potentially leading to account compromise or malware distribution.
Technical details
The vulnerability is a stored cross-site scripting (XSS) in the Redux Framework's Slider field within user profile settings. The root cause lies in two issues: (1) the user_meta_save() function sanitizes array values but not scalar values, and (2) the Redux_Slider::render() method outputs slider values into unquoted HTML attributes without proper escaping. Additionally, the clean_default() validation method only enforces numeric type casting when values are empty or out of bounds, allowing malicious payloads like '1 tabindex=0 autofocus onfocus=alert(1) x=' to bypass validation due to PHP's loose type comparison. An authenticated attacker with Subscriber-level access or higher can inject arbitrary JavaScript into their user profile that executes in the administrator's browser when viewing the attacker's profile. The fix, merged in September 2026, applies esc_attr() escaping to slider values and improves input sanitization throughout the plugin.
Affected products
- Redux Redux Framework up to and including 4.5.13.1
Timeline
- 2026-09-10: disclosed: CVE-2026-5399 published
- 2026-09-09: patched: Fix merged in GitHub PR #4112