Redux Framework EUVD-2026-83561

Requires an authenticated account with subscriber-level capability or above (PR:L) on a WordPress site running Redux Framework version 4.5.13 or earlier, specifically with the Redux users extension (user meta) functionality in use so the spinner field value is saved via user_meta_save() and later rendered by class-redux-spinner.php. Exploitation is limited by the authentication requirement (attacker needs at least a subscriber account, which favors sites with open registration) and by the need for another user - typically an admin or profile viewer - to load the page that renders the stored spinner value for the injected script to fire. Sites that disable open registration or have upgraded to 4.5.14+ are not exposed.

This is a mid-severity stored XSS (vendor CVSS 6.4, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) requiring authenticated access at subscriber level or above (PR:L), which is a meaningful barrier on well-managed sites but a low one where open/self-registration is enabled. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced - status is 'no public exploit identified at time of analysis' - so the practical urgency is moderate rather than critical. The scope-change flag (S:C) and network vector are consistent with a stored payload injected via the spinner user_meta field that later executes in another user's/admin's browser session, but the impact caps at C:L/I:L because XSS here yields session/context abuse rather than direct server compromise. Signals are internally consistent (CVSS vector matches the description of authenticated subscriber injection); the main risk amplifier is the popularity of the framework, the main dampener is the authentication requirement plus the need for a victim to view the injected page.

An attacker registers or obtains a subscriber-level account on a site running Redux Framework <=4.5.13, then submits a scalar spinner-field value containing a script payload, which bypasses the array-only sanitization in user_meta_save() and is stored in user meta. When an administrator or other user later views a page that renders that value via class-redux-spinner.php render() (unquoted, unescaped data-val attribute), the script executes in their browser. No public exploit code is referenced.