Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field File URL
- ID
- WPSEC-2026-0910
- Plugin
- Redux Framework (redux-framework)
- Affected
- from 4.4.1 before 4.5.16
- Remediation
- Update to 4.5.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- Redux Framework on WPSec AttackSurface
- Fix released
- Published
Description
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file URL of the 'multi_media' field in all versions up to, and including, 4.5.15, due to insufficient output escaping of the stored URL and the file name taken from it. Submitted values are only filtered with wp_kses_post, which leaves double quotes in place. This makes it possible for authenticated attackers with Subscriber-level access and above, on sites where a theme or plugin places a multi_media field on user profiles, to inject arbitrary web scripts through their own profile that execute when a user, including an administrator, views that profile.
References
- https://wpsec.com/vuln/WPSEC-2026-0910/
- https://plugins.svn.wordpress.org/redux-framework/tags/4.5.16/
- https://wordpress.org/plugins/redux-framework/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS