{
 "id": "WPSEC-2026-2318",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2318/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2318/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2318/index.md",
 "title": "Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic CSS Output",
 "description": "The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CSS-emitting metabox and user profile field values in all versions up to, and including, 4.5.16, due to the generated dynamic CSS being HTML-entity-decoded and printed inside a <style> element without removing markup, and CSS validation not covering nested field values. HTML entities survive the wp_kses_post input sanitization and are turned back into markup at output. This makes it possible for authenticated attackers, with contributor-level access and above (through post metabox fields that emit CSS), or subscriber-level access and above (through user profile fields that emit CSS, when the site outputs dynamic CSS in the admin area), to break out of the style element and inject arbitrary web scripts that execute whenever a user accesses an affected page.",
 "plugin": {
  "slug": "redux-framework",
  "name": "Redux Framework",
  "full_name": "Redux Framework",
  "wordpress_org": "https://wordpress.org/plugins/redux-framework/",
  "advisories_url": "https://wpsec.com/vuln/plugin/redux-framework/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/redux-framework"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.5.17",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.5.17"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.5.17",
 "remediation": "Update to 4.5.17 or later.",
 "fix_released": "2026-11-02T10:22:44+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:38:59.978422+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2318/",
  "https://plugins.svn.wordpress.org/redux-framework/tags/4.5.17/",
  "https://wordpress.org/plugins/redux-framework/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/redux-framework",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}