Live › vulnerability › CVE-2026-102918
The Redux Framework plugin for WordPress fails to escape a stored multi_media field value, and a Subscriber can save that field through a user-id mismatch in the permission check. An attacker can plant a script in their own profile that runs in an administrator's browser when the administrator views that profile in the dashboard.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running Redux Framework up to and including 4.5.15 where a theme or plugin registers a multi_media field through the Redux Users API. Subscriber-level accounts can reach the flaw, and the payload executes when an administrator opens the affected user's profile in the dashboard. Sites without that registered field, or without the Redux Users API in use, are not exposed as described.
No product ranges from the sources yet.
4.5.15 or earlier in the WordPress plugins screen.multi_media field through the Redux Users API.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API.
This page as .md · .json · in your agent: get_signal("CVE-2026-102918")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.