Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic CSS Output
- ID
- WPSEC-2026-2318
- Plugin
- Redux Framework (redux-framework)
- Affected
- all versions before 4.5.17
- Remediation
- Update to 4.5.17 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Redux Framework on WPSec AttackSurface
- Fix released
- Published
Description
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CSS-emitting metabox and user profile field values in all versions up to, and including, 4.5.16, due to the generated dynamic CSS being HTML-entity-decoded and printed inside a <style> element without removing markup, and CSS validation not covering nested field values. HTML entities survive the wp_kses_post input sanitization and are turned back into markup at output. This makes it possible for authenticated attackers, with contributor-level access and above (through post metabox fields that emit CSS), or subscriber-level access and above (through user profile fields that emit CSS, when the site outputs dynamic CSS in the admin area), to break out of the style element and inject arbitrary web scripts that execute whenever a user accesses an affected page.
References
- https://wpsec.com/vuln/WPSEC-2026-2318/
- https://plugins.svn.wordpress.org/redux-framework/tags/4.5.17/
- https://wordpress.org/plugins/redux-framework/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS