{
 "id": "WPSEC-2026-2317",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2317/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2317/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2317/index.md",
 "title": "Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field",
 "description": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multi_media' field in all versions up to, and including, 4.5.16, due to insufficient input sanitization of nested array keys and missing output escaping of the stored array key in the field's id attribute. This makes it possible for authenticated attackers, with subscriber-level access and above, on sites that use a multi_media field in a user profile, to inject arbitrary web scripts that execute whenever a user views the affected profile page.",
 "plugin": {
  "slug": "redux-framework",
  "name": "Redux Framework",
  "full_name": "Redux Framework",
  "wordpress_org": "https://wordpress.org/plugins/redux-framework/",
  "advisories_url": "https://wpsec.com/vuln/plugin/redux-framework/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/redux-framework"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.4.1",
    "from_inclusive": true,
    "to": "4.5.17",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.4.1 before 4.5.17"
  ]
 },
 "introduced_in": "4.4.1",
 "fixed_in": "4.5.17",
 "remediation": "Update to 4.5.17 or later.",
 "fix_released": "2026-11-02T10:22:44+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:38:59.978422+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2317/",
  "https://plugins.svn.wordpress.org/redux-framework/tags/4.5.17/",
  "https://wordpress.org/plugins/redux-framework/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/redux-framework",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}