Stored Cross-Site Scripting in Redux Framework for WordPress

CVE-2026-102918

What is CVE-2026-102918?

The Redux Framework plugin for WordPress contains a security flaw that allows authenticated users with Subscriber-level permissions to inject malicious scripts into their profile. This vulnerability stems from the mishandling of the multi_media field, where the stored value is output into an HTML context without proper escaping. Furthermore, the permissions check for the field is improperly implemented, enabling unauthorized manipulation of elements that should be restricted. The issue arises in versions up to and including 4.5.15, making it a critical concern for users. When an administrator views a compromised profile in the dashboard, the injected script executes, potentially compromising the site.

References