Vulnerabilities / Redux Framework / WPSEC-2026-2317
Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field
Medium 6.4
CWE-79Fixed in 4.5.17
- ID
- WPSEC-2026-2317
- Plugin
- Redux Framework (redux-framework)
- Affected
- from 4.4.1 before 4.5.17
- Remediation
- Update to 4.5.17 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Redux Framework on WPSec AttackSurface
- Fix released
- Published
Description
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multi_media' field in all versions up to, and including, 4.5.16, due to insufficient input sanitization of nested array keys and missing output escaping of the stored array key in the field's id attribute. This makes it possible for authenticated attackers, with subscriber-level access and above, on sites that use a multi_media field in a user profile, to inject arbitrary web scripts that execute whenever a user views the affected profile page.
References
- https://wpsec.com/vuln/WPSEC-2026-2317/
- https://plugins.svn.wordpress.org/redux-framework/tags/4.5.17/
- https://wordpress.org/plugins/redux-framework/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS