Stored Cross-Site Scripting Vulnerability in Redux Framework Plugin for WordPress

CVE-2026-104812

What is CVE-2026-104812?

The Redux Framework plugin for WordPress exposes a vulnerability that allows authenticated attackers with subscriber-level access and above to execute arbitrary web scripts. This is facilitated through an insufficient input sanitization mechanism associated with the 'multi_media' field array key. The flaw stems from the application of wp_kses_post sanitization, which only operates on array leaf values, thereby leaving the array keys unsanitized. Consequently, these keys are rendered directly within the id='filelist-' HTML attribute without proper escaping via esc_attr() in the Redux_Multi_Media::render() method. The exploitation of this vulnerability can lead to harmful scripts being executed on the pages accessed by users.

References