Redux Framework
Monthly
Privilege escalation in the Redux Framework WordPress plugin before 4.5.13 allows authenticated Subscriber-level users to become Administrators by writing arbitrary user meta keys through the plugin's custom profile fields, on sites where the Users extension (user-profile feature) is enabled. Because the plugin does not restrict which user meta keys are written when saving custom profile fields, an attacker can inject the wp_capabilities meta to grant themselves the administrator role. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.14% and there is no evidence of active exploitation.
Redux Framework through 4.5.15 leaks its complete stored options payload - plaintext password field values, API keys, license keys and SMTP credentials - to any subscriber-level user who simply loads wp-admin/profile.php and reads the inline redux_<opt_name> JavaScript block in the page source, because the Users extension localizes the full option set without verifying the user's panel capability (CWE-862). The Users extension is loaded automatically for every Redux instance registered by any installed theme or plugin, so every site running an affected copy is exposed whether or not the developer deliberately configured that extension. Exploitation requires an authenticated account at subscriber level or above and is therefore most damaging on sites that allow open self-registration and that store real secrets in Redux options; no public exploit identified at time of analysis, and the vendor fixed the issue in 4.5.16.
Stored cross-site scripting in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.15, lets a Subscriber-level account plant script payloads that execute in an administrator's browser when that admin opens the attacker's profile in wp-admin. Two defects combine: the multi_media field renderer prints stored values unescaped into an href attribute, a hidden input value and an HTML element, and Redux_Extension_Users::user_meta_save() evaluates a field's 'permissions' requirement against a request-body 'checkuser_id' rather than the current user, so a low-privileged user can write a field declared for 'manage_options'. Exploitation is conditional - the site must have a theme or plugin that registers a multi_media field through the Redux Users API - and no public exploit code has been identified at time of analysis; the vendor-released patch is version 4.5.16.
Missing authorization checks in the Redux Framework WordPress plugin, versions through 4.5.16, allow a remote attacker holding a valid low-privileged account on the target site to lift sensitive data embedded in the framework's cache. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so confidentiality is fully impacted while integrity and availability are untouched, and exploitation requires the attacker to already be authenticated (PR:L), with no user interaction. No public exploit code has been identified at time of analysis, and the vendor/Patchstack advisory does not yet specify a fixed version in the supplied data; priority is tracked as this_month rather than immediate action.
Privilege escalation in the Redux Framework WordPress plugin through version 4.5.11 lets an authenticated attacker with only Subscriber-level access escalate to any role, including Administrator, by writing an arbitrary role value during a profile update. The flaw is conditionally exploitable: it only triggers on sites where an active plugin or theme has integrated Redux user-profile fields via Redux_Users::set_profile/set_section/set_field, which is a non-default integration requirement, so having the plugin installed alone is not sufficient. Wordfence rates this 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the attack requires no victim interaction and is network-reachable, and no public exploit code has been identified at time of analysis; the practical limiting factor is the required third-party profile-field integration.
Stored cross-site scripting in the Redux Framework WordPress plugin affects all versions up to and including 4.5.14, letting an authenticated attacker with only Subscriber-level access plant a persistent script payload that later executes in the browsers of other users, including administrators. The chain works by storing a malicious value in user-meta fields (biography, session_tokens via a crafted login User-Agent, or persisted_preferences via the REST API) and then having that tainted data promoted into the site-wide redux_demo option when a media-URL repair runs on the Redux demo panel; the merged value is rendered without output escaping through the 'user-mediaurl' media field path and the bundled jsonview.js. Rated CVSS 3.1 6.4 Medium (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), it requires a low-privileged account and no victim interaction once the merge has occurred, and no public exploit code or confirmed active exploitation was identified at time of analysis; a fix is available in version 4.5.15.
An authorization bypass in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.14, lets an authenticated subscriber-level user delete arbitrary media library attachments - including files owned by administrators - by supplying an attacker-chosen attachment_id. Exploitation depends on a non-default configuration: a Custom Fonts field must be registered on the user profile page via Redux_Users::set_profile(), which causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php and hands the attacker the token needed for the unprotected deletion action. The impact is limited to integrity (deletion of attachments) with no confidentiality exposure or code execution; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV. Vendor-released patch: 4.5.15.
Stored cross-site scripting in the Redux Framework plugin for WordPress through version 4.5.13 lets an authenticated attacker with subscriber-level access or above persist arbitrary JavaScript into user meta via the spinner field, which is later emitted into an unquoted HTML attribute and executed in the browser of any user who views the affected page. Exploitation requires a low-privileged account (PR:L) plus a second user - typically an administrator or profile viewer - loading the injected content, so sites with open or self-registration enabled are at the greatest risk while sites that disable registration or have moved to 4.5.14+ are not exposed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Stored cross-site scripting in the Redux Framework WordPress plugin affects versions up to and including 4.5.13, allowing an authenticated attacker with subscriber-level access or higher to persist arbitrary script into Media field filter values that execute when another user later loads the affected page. The flaw arises from insufficient sanitization of nested array values in user_meta_save() combined with unescaped output of filter CSS values in render(), yielding a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the mandatory low-privilege account and the need for a higher-privileged victim to view the injected content are the primary exploitation constraints.
Stored XSS in Redux Framework (WordPress plugin) through version 4.5.13.1 allows authenticated Subscriber-level users to inject arbitrary JavaScript into their user profile Slider field, which then executes in an Administrator's browser when the admin views that profile. Three compounding weaknesses enable this: the `user_meta_save()` function skips sanitization of scalar (non-array) values, the `Redux_Slider::render()` method writes slider values into unquoted HTML attributes without escaping, and PHP loose-type comparison in `clean_default()` permits crafted strings like `1 tabindex=0 autofocus onfocus=alert(1) x=` to pass numeric validation. Vendor-released patch 4.5.14 was published September 07, 2026; no public exploit code or active exploitation (CISA KEV) is confirmed at time of analysis.
Privilege escalation in the Redux Framework WordPress plugin before 4.5.13 allows authenticated Subscriber-level users to become Administrators by writing arbitrary user meta keys through the plugin's custom profile fields, on sites where the Users extension (user-profile feature) is enabled. Because the plugin does not restrict which user meta keys are written when saving custom profile fields, an attacker can inject the wp_capabilities meta to grant themselves the administrator role. Publicly available exploit code exists (published by WPScan), though EPSS remains low at 0.14% and there is no evidence of active exploitation.
Redux Framework through 4.5.15 leaks its complete stored options payload - plaintext password field values, API keys, license keys and SMTP credentials - to any subscriber-level user who simply loads wp-admin/profile.php and reads the inline redux_<opt_name> JavaScript block in the page source, because the Users extension localizes the full option set without verifying the user's panel capability (CWE-862). The Users extension is loaded automatically for every Redux instance registered by any installed theme or plugin, so every site running an affected copy is exposed whether or not the developer deliberately configured that extension. Exploitation requires an authenticated account at subscriber level or above and is therefore most damaging on sites that allow open self-registration and that store real secrets in Redux options; no public exploit identified at time of analysis, and the vendor fixed the issue in 4.5.16.
Stored cross-site scripting in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.15, lets a Subscriber-level account plant script payloads that execute in an administrator's browser when that admin opens the attacker's profile in wp-admin. Two defects combine: the multi_media field renderer prints stored values unescaped into an href attribute, a hidden input value and an HTML element, and Redux_Extension_Users::user_meta_save() evaluates a field's 'permissions' requirement against a request-body 'checkuser_id' rather than the current user, so a low-privileged user can write a field declared for 'manage_options'. Exploitation is conditional - the site must have a theme or plugin that registers a multi_media field through the Redux Users API - and no public exploit code has been identified at time of analysis; the vendor-released patch is version 4.5.16.
Missing authorization checks in the Redux Framework WordPress plugin, versions through 4.5.16, allow a remote attacker holding a valid low-privileged account on the target site to lift sensitive data embedded in the framework's cache. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so confidentiality is fully impacted while integrity and availability are untouched, and exploitation requires the attacker to already be authenticated (PR:L), with no user interaction. No public exploit code has been identified at time of analysis, and the vendor/Patchstack advisory does not yet specify a fixed version in the supplied data; priority is tracked as this_month rather than immediate action.
Privilege escalation in the Redux Framework WordPress plugin through version 4.5.11 lets an authenticated attacker with only Subscriber-level access escalate to any role, including Administrator, by writing an arbitrary role value during a profile update. The flaw is conditionally exploitable: it only triggers on sites where an active plugin or theme has integrated Redux user-profile fields via Redux_Users::set_profile/set_section/set_field, which is a non-default integration requirement, so having the plugin installed alone is not sufficient. Wordfence rates this 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the attack requires no victim interaction and is network-reachable, and no public exploit code has been identified at time of analysis; the practical limiting factor is the required third-party profile-field integration.
Stored cross-site scripting in the Redux Framework WordPress plugin affects all versions up to and including 4.5.14, letting an authenticated attacker with only Subscriber-level access plant a persistent script payload that later executes in the browsers of other users, including administrators. The chain works by storing a malicious value in user-meta fields (biography, session_tokens via a crafted login User-Agent, or persisted_preferences via the REST API) and then having that tainted data promoted into the site-wide redux_demo option when a media-URL repair runs on the Redux demo panel; the merged value is rendered without output escaping through the 'user-mediaurl' media field path and the bundled jsonview.js. Rated CVSS 3.1 6.4 Medium (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), it requires a low-privileged account and no victim interaction once the merge has occurred, and no public exploit code or confirmed active exploitation was identified at time of analysis; a fix is available in version 4.5.15.
An authorization bypass in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.14, lets an authenticated subscriber-level user delete arbitrary media library attachments - including files owned by administrators - by supplying an attacker-chosen attachment_id. Exploitation depends on a non-default configuration: a Custom Fonts field must be registered on the user profile page via Redux_Users::set_profile(), which causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php and hands the attacker the token needed for the unprotected deletion action. The impact is limited to integrity (deletion of attachments) with no confidentiality exposure or code execution; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV. Vendor-released patch: 4.5.15.
Stored cross-site scripting in the Redux Framework plugin for WordPress through version 4.5.13 lets an authenticated attacker with subscriber-level access or above persist arbitrary JavaScript into user meta via the spinner field, which is later emitted into an unquoted HTML attribute and executed in the browser of any user who views the affected page. Exploitation requires a low-privileged account (PR:L) plus a second user - typically an administrator or profile viewer - loading the injected content, so sites with open or self-registration enabled are at the greatest risk while sites that disable registration or have moved to 4.5.14+ are not exposed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Stored cross-site scripting in the Redux Framework WordPress plugin affects versions up to and including 4.5.13, allowing an authenticated attacker with subscriber-level access or higher to persist arbitrary script into Media field filter values that execute when another user later loads the affected page. The flaw arises from insufficient sanitization of nested array values in user_meta_save() combined with unescaped output of filter CSS values in render(), yielding a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the mandatory low-privilege account and the need for a higher-privileged victim to view the injected content are the primary exploitation constraints.
Stored XSS in Redux Framework (WordPress plugin) through version 4.5.13.1 allows authenticated Subscriber-level users to inject arbitrary JavaScript into their user profile Slider field, which then executes in an Administrator's browser when the admin views that profile. Three compounding weaknesses enable this: the `user_meta_save()` function skips sanitization of scalar (non-array) values, the `Redux_Slider::render()` method writes slider values into unquoted HTML attributes without escaping, and PHP loose-type comparison in `clean_default()` permits crafted strings like `1 tabindex=0 autofocus onfocus=alert(1) x=` to pass numeric validation. Vendor-released patch 4.5.14 was published September 07, 2026; no public exploit code or active exploitation (CISA KEV) is confirmed at time of analysis.