CVE-2026-5410 Overview
CVE-2026-5410 is a Stored Cross-Site Scripting (XSS) vulnerability in the Redux Framework plugin for WordPress, affecting versions up to and including 4.5.13. The flaw resides in the plugin's spinner field handling, where scalar values bypass sanitization logic that only processes arrays. Authenticated attackers with subscriber-level access or above can inject arbitrary JavaScript that executes when other users visit affected pages. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Low-privileged authenticated users can persist arbitrary scripts in user meta that execute in the browsers of visitors accessing injected pages, enabling session theft, account takeover, and site-wide compromise.
Affected Products
- Redux Framework plugin for WordPress, versions up to and including 4.5.13
- Fixed in Redux Framework 4.5.14
- Any WordPress site permitting subscriber-level registration with the vulnerable plugin active
Discovery Timeline
- 2026-09-19 - CVE-2026-5410 published to the National Vulnerability Database (NVD)
- 2026-09-21 - Last updated in NVD
Technical Details for CVE-2026-5410
Vulnerability Analysis
The vulnerability arises from a mismatch between the sanitization logic and the data types the plugin accepts. The user_meta_save() function inside class-redux-extension-users.php iterates and sanitizes array values but fails to apply equivalent handling to scalar inputs. Scalar values submitted to the spinner field bypass sanitization entirely and are written directly to user meta storage.
When the plugin later renders the stored value through the render() function in class-redux-spinner.php, it concatenates the raw meta value into an HTML attribute without escaping. The relevant sink at line 56 is $data_string .= ' data-val=' . $this->value;, which places the value in an unquoted attribute context. This allows an attacker to break out of the attribute and inject event handlers or full script payloads.
Root Cause
Two defects combine to produce the flaw. First, user_meta_save() only sanitizes array inputs, ignoring scalar submissions. Second, the spinner field's render() method outputs the value in an unquoted HTML attribute without applying esc_attr() or equivalent escaping. Reference: WordPress Redux Spinner Class.
Attack Vector
An attacker authenticates as a subscriber-level user or higher. The attacker submits a crafted scalar payload to the spinner field, where the value bypasses sanitization and is stored persistently in user meta. When an administrator, editor, or other user loads a page that renders the stored value, the injected script executes in their browser session. See the Wordfence Vulnerability Analysis and the WordPress Redux User Extension source for technical context.
No verified proof-of-concept code is published. The exploitation pattern follows the standard stored XSS model: submit a scalar spinner value containing an HTML attribute break followed by an event handler such as onmouseover, then wait for privileged users to render the injected page.
Detection Methods for CVE-2026-5410
Indicators of Compromise
- Unexpected HTML fragments, event handlers, or <script> markers inside wp_usermeta rows tied to Redux spinner field keys.
- WordPress user accounts created recently at subscriber level that subsequently modified profile fields exposed by Redux Framework.
- Outbound requests from administrator browsers to unfamiliar domains shortly after loading pages rendering Redux user meta.
Detection Strategies
- Query wp_usermeta for spinner field entries containing characters such as <, >, ", ', or the strings onerror, onmouseover, or javascript:.
- Enable WordPress audit logging for user meta writes and correlate low-privilege users writing to Redux-controlled meta keys.
- Deploy a Web Application Firewall (WAF) rule to flag POST requests to Redux endpoints containing HTML control characters in spinner field parameters.
Monitoring Recommendations
- Monitor administrator session activity for anomalous XHR or fetch traffic originating from wp-admin pages that render Redux fields.
- Alert on new WordPress user registrations followed by profile edits touching Redux extension fields within short time windows.
- Track plugin version inventory across WordPress deployments to identify hosts still running Redux Framework 4.5.13 or earlier.
How to Mitigate CVE-2026-5410
Immediate Actions Required
- Upgrade Redux Framework to version 4.5.14 or later on every WordPress installation.
- Audit all subscriber-and-above accounts, removing untrusted or unused users to reduce the exploitable population.
- Review wp_usermeta for stored payloads and sanitize or remove any suspicious entries before administrators load affected pages.
Patch Information
The vendor addressed the flaw in Redux Framework 4.5.14. The fix corrects the sanitization gap in user_meta_save() and hardens the spinner field render path. Review the WordPress Redux Change Set 3688279 and the WordPress Redux Changeset Comparison for the code diff.
Workarounds
- Disable open user registration or restrict the subscriber role until the plugin is updated.
- Deactivate the Redux Framework users extension if the site does not require Redux-managed user meta fields.
- Apply a WAF virtual patch that strips HTML metacharacters from Redux spinner field submissions until the upgrade is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
