CVE-2026-5399 Overview
The Redux Framework plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the Slider field of User Profile settings. The flaw affects all versions up to and including 4.5.13.1. Authenticated attackers with Subscriber-level access or above can inject arbitrary JavaScript into their own user profile. The payload executes when an Administrator views the attacker's profile page, enabling session theft, account takeover, or privileged action abuse. The vulnerability is classified as [CWE-79].
Critical Impact
A low-privileged Subscriber can escalate to full site compromise by planting a stored payload that fires in an Administrator's browser session.
Affected Products
- Redux Framework plugin for WordPress, versions <= 4.5.13.1
- Sites exposing the Users extension with the Slider field
- WordPress installations allowing Subscriber-level or higher registration
Discovery Timeline
- 2026-09-10 - CVE-2026-5399 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-5399
Vulnerability Analysis
The vulnerability chains three distinct weaknesses in the Redux Framework's user profile handling. The user_meta_save() function in the Users extension sanitizes only array values and leaves scalar inputs untouched. The Redux_Slider::render() method then emits the stored value into an HTML attribute without quoting. Combined, these defects allow attacker-controlled text to break out of the intended attribute context and inject event handlers. Because the payload is stored in user metadata, it executes on every administrator view of the affected profile.
Root Cause
The clean_default() method casts values to numeric types only when the input is empty or outside expected bounds. PHP's loose type comparison treats a string beginning with a digit as satisfying numeric comparisons. A payload such as 1 tabindex=0 autofocus onfocus=alert(1) x= passes the boundary check while remaining a full attacker-controlled string when rendered.
Attack Vector
An authenticated attacker submits the crafted string as the Slider field value in their user profile. The plugin persists the unsanitized scalar to user meta. When an administrator opens the profile view, Redux_Slider::render() writes the string into an unquoted attribute. The browser parses the injected autofocus onfocus= handler and executes attacker-supplied JavaScript in the administrator's authenticated session.
Refer to the Wordfence Vulnerability Analysis and the GitHub Pull Request Changes for the code-level details.
Detection Methods for CVE-2026-5399
Indicators of Compromise
- User meta records containing HTML event handler substrings such as onfocus=, onload=, onerror=, or autofocus in Slider field values.
- Administrator sessions issuing unexpected REST API or admin-ajax.php calls immediately after viewing a user profile page.
- Newly created administrator accounts or role changes following profile page visits by privileged users.
Detection Strategies
- Query the wp_usermeta table for Redux Slider field keys and flag values containing non-numeric characters or angle brackets.
- Inspect web server logs for POST requests to profile update endpoints originating from Subscriber accounts that include suspicious attribute syntax.
- Deploy a web application firewall rule that inspects Redux Framework user profile parameters for HTML event handler tokens.
Monitoring Recommendations
- Alert on administrator profile views followed by privileged configuration changes within a short time window.
- Monitor plugin version inventory across managed WordPress sites and flag any Redux Framework install at or below 4.5.13.1.
- Track creation of new user accounts with elevated roles for correlation with profile access events.
How to Mitigate CVE-2026-5399
Immediate Actions Required
- Update the Redux Framework plugin to a version above 4.5.13.1 as soon as a patched release is available on the WordPress plugin repository.
- Audit wp_usermeta for existing malicious payloads in Slider field values and remove or normalize any non-numeric entries.
- Restrict user registration to trusted parties and review current Subscriber-level accounts for unexpected additions.
Patch Information
The upstream fix is tracked in GitHub Pull Request 4112, which corrects the sanitization in user_meta_save() and the output escaping in Redux_Slider::render(). Site operators should apply the vendor patch through the WordPress plugin updater once released and confirm the plugin version reflects the fixed build.
Workarounds
- Disable the Redux Framework Users extension until the plugin can be patched.
- Remove the Slider field from user profile configurations if the extension is required for other features.
- Enforce a strict Content Security Policy that blocks inline event handlers in the WordPress admin interface.
- Require administrators to use a dedicated browser profile or session for reviewing user accounts to limit blast radius.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
