# Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic CSS Output

- **ID:** WPSEC-2026-2318
- **Plugin:** Redux Framework (`redux-framework`), https://wordpress.org/plugins/redux-framework/
- **Affected versions:** all versions before 4.5.17
- **Fixed in:** 4.5.17 (Update to 4.5.17 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/redux-framework
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2318/

## Description

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CSS-emitting metabox and user profile field values in all versions up to, and including, 4.5.16, due to the generated dynamic CSS being HTML-entity-decoded and printed inside a <style> element without removing markup, and CSS validation not covering nested field values. HTML entities survive the wp_kses_post input sanitization and are turned back into markup at output. This makes it possible for authenticated attackers, with contributor-level access and above (through post metabox fields that emit CSS), or subscriber-level access and above (through user profile fields that emit CSS, when the site outputs dynamic CSS in the admin area), to break out of the style element and inject arbitrary web scripts that execute whenever a user accesses an affected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2318/
- https://plugins.svn.wordpress.org/redux-framework/tags/4.5.17/
- https://wordpress.org/plugins/redux-framework/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2318/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.