# Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field File URL

- **ID:** WPSEC-2026-0910
- **Plugin:** Redux Framework (`redux-framework`), https://wordpress.org/plugins/redux-framework/
- **Affected versions:** from 4.4.1 before 4.5.16
- **Fixed in:** 4.5.16 (Update to 4.5.16 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/redux-framework
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0910/

## Description

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file URL of the 'multi_media' field in all versions up to, and including, 4.5.15, due to insufficient output escaping of the stored URL and the file name taken from it. Submitted values are only filtered with wp_kses_post, which leaves double quotes in place. This makes it possible for authenticated attackers with Subscriber-level access and above, on sites where a theme or plugin places a multi_media field on user profiles, to inject arbitrary web scripts through their own profile that execute when a user, including an administrator, views that profile.

## References

- https://wpsec.com/vuln/WPSEC-2026-0910/
- https://plugins.svn.wordpress.org/redux-framework/tags/4.5.16/
- https://wordpress.org/plugins/redux-framework/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0910/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.