Executive brief
Redux Framework is a WordPress plugin that provides configuration and customization tools for WordPress sites. A stored cross-site scripting vulnerability in the Media field allows authenticated users with subscriber-level access to inject malicious scripts that execute when other users visit affected pages. Attackers could use this to deface pages, steal administrative credentials, or spread malware through the WordPress site.
Technical details
The vulnerability exists in the user_meta_save() function due to insufficient sanitization of nested array values in Media field filters, and in the render() function due to unsafe output of filter CSS values without proper escaping. An authenticated attacker with subscriber-level or higher permissions can inject arbitrary JavaScript through the Media field filter interface; the script persists and executes in the browsers of all users who access the affected page. A patch is available in pull request #4112 with improved escaping and sanitization.
Affected products
- Redux Framework Redux Framework up to and including 4.5.13
Timeline
- 2026-09-19: disclosed
- 2026-09-09: patched: Fix merged in pull request #4112