Description

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-19T08:16:54.190Z",
  "pubdate": "2026-09-19T08:16:54.190Z",
  "executiveSummary": "The Redux Framework plugin for WordPress, in versions up to and including 4.5.13, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability originates from improper input sanitization and insecure output rendering within the plugin's core architecture.\nAuthenticated attackers with at least subscriber-level privileges can inject arbitrary JavaScript payloads into Media field filter values.\nThe malicious script is persisted within the WordPress database and subsequently executed in the browser context of any user, including administrators, who accesses the affected page.\nThe risk is significant as successful exploitation allows for unauthorized actions, session hijacking, credential theft, and complete compromise of the victim's session, potentially leading to unauthorized administrative modifications of the WordPress site.\nThis vulnerability is particularly critical due to the ease of exploitation by authenticated users with low-level privileges, necessitating immediate attention and remediation.",
  "technicalDetails": "The vulnerability is primarily rooted in two distinct locations within the Redux Framework plugin's codebase: the user_meta_save() function and the render() function.\nIn the user_meta_save() function, the plugin fails to perform adequate input sanitization when processing nested array values associated with Media field filters. This failure allows arbitrary, unvalidated data to be stored directly into the database.\nThe secondary flaw exists in the render() function, which is responsible for displaying the saved filter CSS values. The plugin outputs these values without implementing necessary contextual output escaping or encoding. This ensures that any malicious payload injected during the save phase is interpreted as executable HTML/JavaScript by the browser when the component is rendered.\nThe attack vector requires a user to possess at least subscriber-level authentication. Once authenticated, the attacker crafts a malicious request targeting the Media field filter values. By embedding a script payload within these fields, the attacker leverages the plugin's save logic to commit the script to the database.\nThe attack flow proceeds as follows: 1) The attacker transmits a crafted POST request containing an XSS payload to the vulnerable endpoint handled by the user_meta_save() function. 2) The server-side code accepts the payload due to the lack of recursive sanitization for nested arrays. 3) The malicious content is stored as metadata within the WordPress database. 4) When an administrative user or any other user accesses the page where this Media field is rendered, the vulnerable render() function outputs the stored data directly into the DOM.\nBecause there is no output escaping, the browser treats the stored payload as a legitimate script tag or event handler, executing it within the security context of the victim's session. This allows the attacker to execute arbitrary actions on behalf of the victim, such as modifying plugin configurations, creating new administrative accounts, or exfiltrating sensitive session cookies.\nThe impact is persistent and global for every user viewing the affected page, effectively weaponizing the application's own administrative interfaces against its users."
}