Description

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, at line 56 of class-redux-spinner.php in the render() function, this value is rendered in an unquoted HTML attribute without escaping via '$data_string .= ' data-val=' . $this->value;'. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-19T09:16:34.307Z",
  "pubdate": "2026-09-19T09:16:34.307Z",
  "executiveSummary": "The Redux Framework plugin for WordPress, in versions up to and including 4.5.13, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from inadequate input sanitization and a failure to perform output encoding within the spinner field component.\nThe vulnerability allows authenticated attackers with subscriber-level privileges or higher to inject malicious JavaScript payloads into user meta fields. When these fields are subsequently rendered in the administrative interface or frontend, the injected script executes within the context of the victim's browser session.\nThe primary risk involves the unauthorized execution of client-side code, which can be leveraged for session hijacking, administrative account takeover, unauthorized actions performed on behalf of legitimate users, or the redirection of victims to malicious domains. The impact is critical, as it bypasses standard security controls due to the inherent trust placed in administrative or user meta data.\nExploitation requires authenticated access to the application, but given that subscriber-level access is sufficient, the attack surface remains broad across many WordPress installations utilizing the Redux Framework.",
  "technicalDetails": "The vulnerability is primarily located within the input processing logic of the Redux Framework. The user_meta_save() function is responsible for persisting user meta data; however, it employs flawed conditional logic that only applies sanitization routines when input is provided as an array. When scalar values are submitted via the spinner field, they bypass these sanitization mechanisms entirely, allowing raw, malicious input to be stored directly into the database.\nThe second critical failure point occurs at line 56 of class-redux-spinner.php. During the render() function, the plugin retrieves the stored value and constructs an HTML attribute without implementing necessary output escaping. Specifically, the line '$data_string .= ' data-val=' . $this->value;' injects the raw, unsanitized user-supplied value directly into an unquoted HTML attribute. Because the attribute is unquoted, an attacker can prematurely terminate the attribute definition using whitespace or HTML tags, enabling the injection of arbitrary event handlers such as 'onmouseover' or 'onerror'.\nThe attack flow proceeds as follows: First, an authenticated attacker crafts a request to the user meta update endpoint, passing a malicious payload within the spinner field parameter. Since the system treats this as a scalar value, it enters the database in its entirety without filtering. Second, when a victim—typically an administrator or another user—navigates to a page where the Redux spinner field is rendered, the application processes the stored malicious data. Third, the browser parses the unquoted attribute and the injected script context, resulting in the immediate execution of the payload within the victim's session.\nThis vulnerability is classified as Stored XSS because the malicious script is persisted in the backend database. The lack of context-aware output escaping is the primary root cause, transforming a data storage flaw into a DOM-based execution vector. Because the vulnerability manifests during the rendering process in administrative panels, the potential for privilege escalation or full site compromise is high, as the script executes with the permissions of the user viewing the affected page."
}