Stored Cross-Site Scripting Vulnerability in Redux Framework Plugin for WordPress

CVE-2026-120533

What is CVE-2026-120533?

The Redux Framework plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'theme_opts' parameter in user profiles. This vulnerability arises from inadequate sanitization of input and output, allowing authenticated users, with subscriber access or higher, to inject malicious scripts into pages. When another user accesses an affected page, these scripts execute in their browser, leading to potential session hijacking or other malicious activities. The exploitation hinges on the host theme incorporating a registered Redux field that outputs CSS, as only specific field types undergo validation, leaving others open to attack.

References