Redux Framework CVE-2026-90992

Requires an authenticated WordPress account at Subscriber level or above (PR:L) on a site running Redux Framework ≤4.5.14, plus the ability to self-register or otherwise obtain such an account. The attacker stores a payload in a user-meta field (biography, session_tokens via a crafted login User-Agent, or persisted_preferences via the REST API). Exploitation is gated on a media-URL repair being triggered on the Redux demo panel, which merges and promotes the tainted user meta into the site-wide redux_demo option - typically an administrator-initiated maintenance action - after which the unescaped payload renders and executes when any user views the injected page.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4 Medium) describes a network-exploitable stored XSS requiring only low privileges (Subscriber) and no user interaction, with a scope change (S:C) because injected script executes in the browser context of other users viewing the affected page. There is no EPSS score, no CISA KEV listing, and no public exploit code provided in the input, so this is: no public exploit identified at time of analysis. Real-world risk is moderate rather than urgent: the authenticated Subscriber prerequisite and, critically, the requirement that a media-URL 'repair' be triggered on the Redux demo panel (an administrator-facing maintenance action) to promote the attacker-stored user-meta payload into the site-wide redux_demo option meaningfully gate exploitation beyond what the UI:N metric suggests. The S:C/C:L/I:L impact reflects typical stored-XSS consequences (session/cookie theft, limited content manipulation) rather than direct server compromise. Net: a legitimate issue worth patching on sites that allow self-registration, but not a drop-everything priority absent exploitation signals.

An attacker registers or uses a Subscriber-level account and stores a crafted JavaScript payload in a user-meta field - for example the biography, session_tokens (via a malicious User-Agent string at login), or persisted_preferences (via the REST API). When a site administrator later triggers a media-URL repair on the Redux demo panel, the tainted user meta is merged and promoted into the site-wide redux_demo option, where it is rendered without proper escaping and executes in the browser of anyone viewing the injected page. No public proof-of-concept is referenced in the provided data.