CVE-2026-90992 Overview
The Redux Framework plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 4.5.14. The flaw resides in the user-mediaurl Media Field and stems from insufficient input sanitization and output escaping during a User Meta Merge operation. Authenticated attackers with Subscriber-level access or above can inject arbitrary web scripts that execute when users visit affected pages. The vulnerability is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Low-privileged WordPress users can escalate influence site-wide by promoting attacker-controlled payloads stored in user meta into the redux_demo option, enabling script execution against any user who loads the demo panel.
Affected Products
- Redux Framework plugin for WordPress — all versions through 4.5.14
- WordPress sites running the Redux Framework users extension
- Sites exposing the Redux demo panel with media URL repair functionality
Discovery Timeline
- 2026-10-01 - CVE CVE-2026-90992 published to NVD
- 2026-10-01 - Last updated in NVD database
Technical Details for CVE-2026-90992
Vulnerability Analysis
The vulnerability resides in the Redux Framework users extension, specifically in logic that merges user meta into the plugin's site-wide redux_demo option. The user-mediaurl Media Field accepts data without applying adequate sanitization on input or escaping on output. When the plugin promotes user-controlled meta values into the shared option during a media URL repair action, any embedded script payload is preserved and later rendered in administrative or demo contexts.
Because the stored payload is scoped to a shared option rather than per-user metadata, the impact crosses the privilege boundary from a Subscriber account to any viewer of the demo panel. Relevant code paths include the class-redux-extension-users.php user extension logic and the class-redux-users-api.php REST handling, as documented in the Redux User Extension Class and the Redux Users API Class.
Root Cause
The root cause is twofold. First, user meta fields such as biography, session_tokens, and persisted_preferences are not sanitized before storage. Second, the User Meta Merge routine that promotes these values into the redux_demo option neither validates nor escapes the payloads before they are consumed by the demo panel renderer and the bundled jsonview.js output. See the WordPress JSONView Script for the affected rendering path.
Attack Vector
An authenticated Subscriber can store a payload through multiple entry points: the user biography field, session_tokens seeded with a crafted User-Agent header at login, or persisted_preferences written through the REST API. Once stored, triggering the media URL repair on the demo panel promotes the payload into the shared redux_demo option. Any subsequent visit to a page that renders this option executes the attacker-supplied JavaScript in the victim's browser session. Technical details are described in the Wordfence Vulnerability Analysis.
Detection Methods for CVE-2026-90992
Indicators of Compromise
- Unexpected <script> tags, event handlers, or JavaScript URIs present within the redux_demo option in the wp_options table.
- User meta rows for biography, session_tokens, or persisted_preferences containing HTML or JavaScript content tied to Subscriber accounts.
- Login records showing anomalous or oversized User-Agent strings associated with newly registered Subscriber users.
- REST API calls from low-privileged accounts writing to Redux user preferences endpoints.
Detection Strategies
- Query wp_options for the redux_demo row and inspect serialized values for script sinks or encoded payloads.
- Audit wp_usermeta for entries containing <script, onerror=, javascript:, or data:text/html substrings.
- Correlate recent Subscriber registrations with REST API writes to Redux endpoints and subsequent admin panel visits.
Monitoring Recommendations
- Alert on write access to redux_demo from non-administrative sessions or background jobs.
- Monitor WordPress REST API traffic to /wp-json/ paths associated with the Redux users extension.
- Track administrator browser errors or Content Security Policy (CSP) violations originating from the Redux demo panel.
How to Mitigate CVE-2026-90992
Immediate Actions Required
- Upgrade the Redux Framework plugin to version 4.5.15 or later, which contains the fix referenced in Redux Framework Changeset 3705066.
- Review and sanitize existing values in the redux_demo option and in affected user meta fields on all Subscriber accounts.
- Restrict new user registrations and audit existing Subscriber accounts for recently created, unused identities.
Patch Information
The vendor released version 4.5.15 of the Redux Framework plugin with sanitization and escaping fixes. The code differences between the vulnerable and patched release are available in the Redux Framework Changeset Comparison.
Workarounds
- Disable the Redux Framework users extension if the plugin cannot be updated immediately.
- Remove access to the Redux demo panel in production environments to prevent triggering the media URL repair routine.
- Enforce a strict Content Security Policy on WordPress administrative pages to limit inline script execution.
- Restrict REST API write access to Redux endpoints to Administrator-level users only.
# Configuration example: update Redux Framework via WP-CLI
wp plugin update redux-framework --version=4.5.15
wp option get redux_demo --format=json | less
wp user list --role=subscriber --fields=ID,user_login,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
