Stored Cross-Site Scripting in Redux Framework for WordPress

CVE-2026-5399

What is CVE-2026-5399?

The Redux Framework plugin for WordPress contains a vulnerability that allows authenticated users, with Subscriber-level access or higher, to execute arbitrary web scripts via Stored Cross-Site Scripting. This is primarily due to inadequate input sanitization within the user_meta_save() function, which fails to properly sanitize scalar values. Additionally, improper output escaping in the Redux_Slider::render() method exposes slider values directly into HTML attributes, leading to potential injection of malicious scripts. Exploitation of this vulnerability enables attackers to embed scripts into their profiles, which will execute when an Administrator views their profile page.

References