EUVD-2026-83556
GHSA-hgrh-m798-2mwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain subscriber account
-
DeliverySubmit Media field with scripted nested filter value
-
ExploitPayload stored unsanitized by user_meta_save()
-
Executionrender() outputs filter CSS unescaped
-
ImpactAdmin/user views page, script executes in their session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with subscriber-level access or higher (PR:L) on a site running Redux Framework <=4.5.13, and requires that the attacker can reach a Media field whose filter values are persisted via user_meta_save() (Redux users/meta extension). Exploitation is stored/second-order: the payload only fires when another user - typically an administrator or visitor - subsequently loads the page that renders the injected filter CSS via render(). Limiting factors: authentication is mandatory (not unauthenticated), the vulnerable Media-field-with-filters feature must actually be exposed to lower-privileged users, and successful impact depends on a higher-privileged user later viewing the injected content. |
| Impact | CVSS 3.1 base 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) describes an authenticated stored XSS reachable over the network with low complexity but requiring subscriber-level privileges (PR:L). No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied intelligence, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC decision data. The signals are internally consistent: a real but moderate-priority issue rather than a critical one - the S:C scope change and the fact that a mere subscriber can plant script that fires in an administrator/visitor browser context raise the ceiling (potential session/cookie theft, admin action forgery), but the PR:L gate, C:L/I:L (no A) impact, and stored/second-order nature (a privileged user must later view the injected page) keep real-world urgency modest. The vendor fix in 4.5.14 (07 Sep 2026) is confirmed by the PR diff and trac changeset, and the CVSS vector is complete, so no key data conflicts; the main missing signals are EPSS and any POC, whose absence is not itself an error. |
| Exploit ScenarioDerived | An attacker registers or obtains a subscriber-level WordPress account on a site using Redux Framework, then submits a Media field whose nested filter/CSS values contain a script payload; user_meta_save() stores the nested array without sanitization and render() later emits the filter CSS values unescaped. When an administrator or other user views the page rendering that field, the injected script executes in their browser. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
Stored cross-site scripting in the Redux Framework WordPress plugin affects versions up to and including 4.5.13, allowing an authenticated attacker with subscriber-level access or higher to persist arbitrary script into Media field filter values that execute when another user later loads the affected page. The flaw arises from insufficient sanitization of nested array values in user_meta_save() combined with unescaped output of filter CSS values in render(), yielding a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the mandatory low-privilege account and the need for a higher-privileged victim to view the injected content are the primary exploitation constraints.
RemediationAI
Upgrade Redux Framework to 4.5.14 (vendor-released patch), which per the changelog fixes XSS vulnerabilities caused by lack of output escaping and validation; the change is captured in the plugin readme stable tag update and changeset 3688279 (https://plugins.trac.wordpress.org/changeset?reponame=&new=3688279%40redux-framework%2Ftags%2F4.5.14&old=3582185%40redux-framework%2Ftags%2F4.5.13) and in upstream pull request #4112 (https://github.com/reduxframework/redux-framework/pull/4112/changes). If Redux is bundled inside a theme or plugin, update that parent component to a release that ships Redux 4.5.14 or later, since updating the standalone plugin alone will not replace an embedded copy; verify by inspecting the bundled framework version after the update. Where updating is not immediately possible, the practical compensating controls are to remove or restrict Media fields that accept filter values from being writable by subscriber-level or otherwise low-privileged accounts, since the vulnerability requires an authenticated account at PR:L or above and a Media field whose filters are persisted through the users extension's user_meta_save() path; the trade-off is loss of legitimate low-privilege customization and possible layout regressions in the consuming theme. Additionally, audit and tightly control subscriber-and-above account provisioning (registration, role-escalation plugins), and consider a WAF rule blocking script or event-handler markup in POST bodies bound to Redux option names as a temporary, partial control, recognizing that WAF bypasses are common for stored XSS and this does not remediate the underlying escape-on-output defect. Review stored filter values in the redux user meta for any already-injected content, since the payload persists until cleaned up even after patching. The vendor advisory with version details and the vulnerability identifier is at https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5b1ff6-19c5-4384-ae63-faf1f40122e7?source=cve.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Redux Framework is a widely bundled WordPress options framework that themes and plugins embed via a config file, and the CPE cpe:2.3:a:davidanderson:redux_framework:*:*:*:*:*:*:*:* identifies the standalone plugin distribution. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored/second-order XSS. In the Media field implementation (redux-core/inc/fields/media/class-redux-media.php, referenced lines 233 and 337), the save path does not deeply sanitize nested array values, so filter sub-keys inside an array-structured field value survive persistence through the users extension's user_meta_save() function (redux-core/inc/extensions/users/class-redux-extension-users.php, referenced line 1034). Those stored filter values are subsequently emitted by render() as CSS without output escaping, so markup embedded in the filter value is interpreted by the browser rather than rendered as text. Because Redux is a framework rather than a self-contained feature, exploitability depends on the consuming theme or plugin actually exposing a Media field whose filters are writable by the lower-privileged account. The upstream fix (pull request #4112, changeset 3688279) broadens default validation by field type, removes ad hoc unescaping/stripslashes logic in the metaboxes, taxonomy, and users extensions, and adds proper escaping on output, which is the consistent signature of an output-escaping plus validation-hardening fix rather than an architectural rewrite.
Know when Redux Framework gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Network-reachable, low-complexity stored XSS requiring a subscriber account (PR:L); script runs in another user's browser so scope changes (S:C) with limited C:L/I:L and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Redux Framework
View allPrivilege escalation in the Redux Framework WordPress plugin before 4.5.13 allows authenticated Subscriber-level users t
Privilege escalation in the Redux Framework WordPress plugin through version 4.5.11 lets an authenticated attacker with
Stored XSS in Redux Framework (WordPress plugin) through version 4.5.13.1 allows authenticated Subscriber-level users to
Stored cross-site scripting in the Redux Framework plugin for WordPress through version 4.5.13 lets an authenticated att
Stored cross-site scripting in the Redux Framework WordPress plugin affects all versions up to and including 4.5.14, let
An authorization bypass in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.14, lets
Exploit-DB