Redux Framework EUVD-2026-114225

Exploitation requires an authenticated Subscriber-level (or higher) account AND a deployment where a theme or plugin registers a multi_media field through the Redux Users API - without that field registration the vulnerable renderer and save path are not reachable, so this is not a default-configuration flaw. The access-control defect in Redux_Extension_Users::user_meta_save() (permissions evaluated against the request-body 'checkuser_id' instead of the current user) is what lets a Subscriber write a field declared for 'manage_options'. Execution is further gated on an administrator actually viewing the attacker's profile in the wp-admin dashboard, so the payload lies dormant until that victim interaction occurs. The fix is to update to Redux Framework 4.5.16.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The input CVSS of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a network-reachable, low-complexity stored XSS whose scope change (S:C) captures script execution in the administrator's authenticated dashboard context. However, several signals pull the real-world risk down: no EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit is identified in the supplied references (which are the Wordfence advisory and plugin source/changeset links, not working exploit code). The vuln.today decision label is 'this_month', consistent with patch-this-cycle rather than act_now/emergency. Two further conditions constrain exploitation and partially conflict with the headline vector: (1) an administrator must actually open the attacker's profile in wp-admin for the payload to fire, which in practice is victim interaction the input vector scores as UI:N but is more honestly UI:R; and (2) the flaw only exists where a theme or plugin registers a multi_media field through the Redux Users API, a non-default integration. The interesting amplifier is the access-control defect - Redux_Extension_Users::user_meta_save() checks the 'permissions' requirement against a request-supplied 'checkuser_id' instead of the current user - which lets a mere Subscriber write a field declared for 'manage_options', turning a low-privilege account into a stored-XSS vector against admins. Net: treat as a real but conditional privilege-escalation-to-admin-XSS, prioritized by product reach rather than by any confirmed exploitation.

An attacker registers or already holds a Subscriber-level account on a WordPress site whose theme or plugin exposes a Redux Users API multi_media field. Abusing the checkuser_id permission-check flaw, the Subscriber saves a crafted multi_media value - a field they should not be allowed to write - containing a script payload that the renderer prints unescaped into an href attribute, a hidden input value, and an HTML element. When an administrator later views that user's profile in the dashboard, the stored script executes in the admin's authenticated session. No public exploit code is identified at time of analysis.