CVE-2026-5400: Redux Framework WordPress Plugin XSS Flaw

CVE-2026-5400 Overview

The Redux Framework plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 4.5.13. The flaw resides in the Media field filter values, where nested array values are insufficiently sanitized in the user_meta_save() function and filter CSS values are output without proper escaping in the render() function. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts that execute when any user views an affected page. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Low-privileged authenticated users can persist JavaScript payloads that execute in the browsers of administrators and other visitors, enabling session theft, account takeover, and site defacement.

Affected Products

• Redux Framework plugin for WordPress, versions up to and including 4.5.13
• Vulnerable functions: user_meta_save() in class-redux-extension-users.php
• Vulnerable functions: render() in class-redux-media.php

Discovery Timeline

• 2026-09-19 - CVE-2026-5400 published to NVD
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-5400

Vulnerability Analysis

The Redux Framework plugin exposes a Media field type that stores associated metadata, including filter values used to render CSS effects on selected media. The plugin's user meta save routine accepts nested array structures submitted by authenticated users and persists them without sufficient sanitization of nested values. When the media field is later rendered, the stored filter values are emitted into the HTML output without proper escaping.

This combination of unsafe input handling and unsafe output produces a stored XSS condition. Because the payload is persisted in the database and rendered on pages viewed by other users, an attacker only needs subscriber-level access to plant scripts that later execute in an administrator's authenticated session.

Root Cause

The vulnerability stems from two coordinated weaknesses. First, user_meta_save() in class-redux-extension-users.php fails to recursively sanitize nested array values submitted through the user meta interface. Second, the render() function in class-redux-media.php inserts stored filter CSS values into the DOM without applying esc_attr() or an equivalent WordPress escaping function. See the WordPress Media Field Class source and the Users Extension Class source for the pre-patch code paths.

Attack Vector

An authenticated attacker with at least subscriber privileges submits a crafted Media field filter value containing an XSS payload delivered inside a nested array. The malicious value is persisted through user_meta_save(). When a WordPress user, including an administrator, loads a page that renders the affected media field, the browser executes the attacker-controlled script in the site's origin. The resulting execution can steal session cookies, perform privileged actions via CSRF, or modify page content. Full technical analysis is available in the Wordfence Vulnerability Analysis.

No verified public proof-of-concept code was available at the time of writing. See the GitHub Pull Request Changes for the fix diff that illustrates the vulnerable sink locations.

Detection Methods for CVE-2026-5400

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or event handlers such as onerror= and onload= stored inside Redux user meta values.
• User meta records created or modified by low-privileged accounts that contain CSS filter values with HTML control characters.
• Outbound requests from administrator browsers to unknown domains immediately after loading pages that render Redux Media fields.

Detection Strategies

• Audit wp_usermeta entries associated with Redux Framework for filter values containing angle brackets, javascript:, or encoded script fragments.
• Enable WordPress admin activity logging and correlate subscriber-level user meta updates with subsequent administrator page views.
• Deploy a Web Application Firewall (WAF) rule that flags POST parameters targeting Redux user meta endpoints with HTML or JavaScript payloads.

Monitoring Recommendations

• Monitor authenticated POST requests to admin-ajax.php and Redux-specific handlers submitted by subscriber accounts.
• Alert on Content Security Policy (CSP) violation reports referencing inline scripts on pages that embed Redux Media fields.
• Track new subscriber account registrations followed by user meta modification activity within a short time window.

How to Mitigate CVE-2026-5400

Immediate Actions Required

• Update Redux Framework to version 4.5.14 or later on all WordPress sites.
• Review existing user meta values for stored payloads and purge any records containing HTML or JavaScript in filter fields.
• Restrict new subscriber registrations if the site does not require public account creation.

Patch Information

The issue is resolved in Redux Framework 4.5.14. The fix adds recursive sanitization of nested array values in user_meta_save() and applies proper escaping to filter CSS output in render(). Refer to the WordPress Changeset for Media Class and the full changeset comparing 4.5.13 to 4.5.14 for the code changes.

Workarounds

• Disable the Redux Framework plugin until the patched version can be deployed.
• Enforce a strict Content Security Policy that disallows inline script execution on WordPress-rendered pages.
• Limit user registration to trusted roles and require administrator approval for new accounts.

# Configuration example: update Redux Framework via WP-CLI
wp plugin update redux-framework --version=4.5.14
wp plugin list --name=redux-framework --fields=name,status,version