Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T08:17:18.687Z",
  "pubdate": "2026-11-06T08:17:18.687Z",
  "executiveSummary": "Redux Framework is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).\nThis vulnerability allows an unauthenticated or authenticated attacker with sufficient access to inject malicious scripts into the application's database, which are subsequently rendered in the browser of other users, including administrators.\nThe flaw affects Redux Framework versions ranging from n/a through 4.5.16.\nSuccessful exploitation allows attackers to execute arbitrary JavaScript within the context of a victim's session, potentially leading to unauthorized actions, session hijacking, or the exfiltration of sensitive information.\nThe risk implication is high, as Stored XSS can be leveraged to compromise administrative accounts, modify site content, or redirect users to malicious domains, depending on the attacker's objectives and the privileges of the victim.",
  "technicalDetails": "The vulnerability originates from inadequate input sanitization and output encoding within the Redux Framework, specifically regarding user-supplied data that is subsequently stored in the database and rendered back to the user without sufficient validation.\nThe attack vector utilizes the persistence mechanism of the framework, where malicious scripts are injected via input fields that are not properly sanitized before being committed to the database. When a target user, such as an administrator, views the affected component within the WordPress dashboard, the browser executes the stored payload.\nThe exploitation flow typically follows these steps: 1. An attacker identifies an input field managed by the Redux Framework that fails to implement server-side sanitization. 2. The attacker submits a specially crafted payload containing malicious JavaScript (e.g., <script>alert(document.cookie)</script>) into this field. 3. The application accepts the input and stores the script directly into the database. 4. A legitimate user (often an administrator) navigates to the page where this stored content is rendered. 5. The application serves the stored script as part of the page content without proper output escaping. 6. The victim's browser treats the script as legitimate content originating from the application and executes it within the security context of the victim's session.\nBecause the payload is stored persistently, it triggers every time a victim views the affected component, amplifying the impact significantly. This allows attackers to perform actions on behalf of the victim, bypass CSRF protections, or exfiltrate session cookies and other sensitive tokens accessible via the Document Object Model (DOM).\nThis vulnerability is particularly severe because the script executes with the privileges of the victim. If an administrator is targeted, the attacker can leverage the XSS to create new administrator accounts, change site settings, or inject further malicious code into the WordPress theme or plugin files, leading to full site compromise.\nThe affected versions include all releases from n/a up to and including 4.5.16. The underlying issue is a failure in the application's sanitization pipeline, which should be applying context-aware output encoding (such as esc_html(), esc_attr(), or esc_js() in the WordPress context) to neutralize potentially executable scripts before rendering."
}