# CVE-2026-5399: Redux Framework WordPress plugin stored XSS in Slider field

Source: https://junglewise.ai/threats/cve-2026-5399-redux-framework-wordpress-plugin-stored-xss-in-slider-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-5399 · Severity: medium · CVSS 6.4 · Published 2026-09-10

Redux Framework is a popular WordPress plugin that manages theme and plugin settings. A stored cross-site scripting (XSS) vulnerability in the Slider field of user profiles allows low-privileged users (Subscriber level and above) to inject malicious scripts that execute when administrators view their profile, potentially leading to account compromise or malware distribution.

## Quick answers

**Is CVE-2026-5399 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5399 being exploited in the wild.

**How severe is CVE-2026-5399?** Medium severity, with a CVSS score of 6.4, published 10 September 2026.

**Which products and versions are affected?** Redux Redux Framework up to and including 4.5.13.1.

**Is there a fix for CVE-2026-5399?** A patch was published on 2026-09-09: Fix merged in GitHub PR #4112 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5399 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5399?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) in the Redux Framework's Slider field within user profile settings. The root cause lies in two issues: (1) the user_meta_save() function sanitizes array values but not scalar values, and (2) the Redux_Slider::render() method outputs slider values into unquoted HTML attributes without proper escaping. Additionally, the clean_default() validation method only enforces numeric type casting when values are empty or out of bounds, allowing malicious payloads like '1 tabindex=0 autofocus onfocus=alert(1) x=' to bypass validation due to PHP's loose type comparison. An authenticated attacker with Subscriber-level access or higher can inject arbitrary JavaScript into their user profile that executes in the administrator's browser when viewing the attacker's profile. The fix, merged in September 2026, applies esc_attr() escaping to slider values and improves input sanitization throughout the plugin.

## Affected products

- Redux Redux Framework up to and including 4.5.13.1

## Timeline

- 2026-09-10: disclosed: CVE-2026-5399 published
- 2026-09-09: patched: Fix merged in GitHub PR #4112

## References

- [https://github.com/reduxframework/redux-framework/pull/4112/changes](https://github.com/reduxframework/redux-framework/pull/4112/changes)
- [https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php](https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php)