Stored Cross-Site Scripting Vulnerability in Redux Framework Plugin for WordPress

CVE-2026-5410

What is CVE-2026-5410?

The Redux Framework plugin for WordPress is susceptible to stored cross-site scripting (XSS) via the spinner field. This vulnerability arises from inadequate input sanitization and output escaping in the user_meta_save() function, where scalar values circumvent the sanitization logic that only processes arrays. As a result, the spinner field value can be stored in user meta without proper sanitization. When the value is rendered in the render() function, it is added to an unquoted HTML attribute, exposing the application to potential XSS attacks. Authenticated users with subscriber-level permissions or higher may exploit this vulnerability to inject malicious scripts into web pages, executing them whenever a user accesses the compromised content.

References