# CVE-2026-5410: Redux Framework plugin WordPress stored XSS in spinner field

Source: https://junglewise.ai/threats/cve-2026-5410-the-redux-framework-plugin-for-wordpress-is-vulnerable-to-stored  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-19. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-5410 · Severity: medium · CVSS 6.4 · Published 2026-09-19

The Redux Framework WordPress plugin allows authenticated users with subscriber access or higher to inject malicious scripts into pages through a spinner form field. When other users view pages containing the injected content, the scripts execute in their browsers, potentially allowing attackers to steal credentials, hijack sessions, or deface content. This vulnerability affects versions up to 4.5.13 and requires an authenticated attacker.

Technologies: [Redux Framework](https://junglewise.ai/threats/technologies/redux-redux-framework). Vendors: [Redux](https://junglewise.ai/threats/vendors/redux).

## Quick answers

**Is CVE-2026-5410 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5410 being exploited in the wild.

**How severe is CVE-2026-5410?** Medium severity, with a CVSS score of 6.4, published 19 September 2026.

**Which products and versions are affected?** Redux Framework up to and including 4.5.13.

**Is there a fix for CVE-2026-5410?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5410 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5410?** Check whether you run Redux Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the user_meta_save() and render() functions where scalar spinner field values bypass array-only sanitization logic and are later rendered in unquoted HTML attributes without escaping. An authenticated attacker with subscriber-level access can inject arbitrary JavaScript through the spinner field, which persists in user meta and executes when the page is viewed by other users. A patch is available in versions after 4.5.13.

## Affected products

- Redux Redux Framework up to and including 4.5.13

## Timeline

- 2026-09-19: disclosed: CVE-2026-5410 published on NVD

## References

- [https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php](https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php)
- [https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/spinner/class-redux-spinner.php](https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/spinner/class-redux-spinner.php)

## Related threats

- [Redux Framework authorization bypass in import/export](https://junglewise.ai/threats/cve-2026-110705-the-redux-framework-plugin-for-wordpress-is-vulnerable-to)
- [Redux Framework stored cross-site scripting in multi_media field](https://junglewise.ai/threats/cve-2026-102918-the-redux-framework-plugin-for-wordpress-is-vulnerable-to-stored)
- [Redux Framework privilege escalation in user profile update](https://junglewise.ai/threats/cve-2025-14123-the-redux-framework-plugin-for-wordpress-is-vulnerable-to)