---
id: "CVE-2026-102918"
kind: "vulnerability"
aliases: ["CVE-2026-102918"]
title: "WordPress Redux Framework plugin: stored XSS via user profile field"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["redux-framework", "runtime", "self-hosted", "wordpress"]
not_affected_if: ["no-multi-media-field", "redux-users-api-unused"]
published_at: "2026-10-30T18:17:14+00:00"
first_seen_at: "2026-10-30T18:55:28+00:00"
updated_at: "2026-10-30T18:57:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102918", "first_seen_at": "2026-10-30T18:55:28+00:00"}]
---

# WordPress Redux Framework plugin: stored XSS via user profile field

The Redux Framework plugin for WordPress fails to escape a stored multi_media field value, and a Subscriber can save that field through a user-id mismatch in the permission check. An attacker can plant a script in their own profile that runs in an administrator's browser when the administrator views that profile in the dashboard.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Redux Framework plugin is installed and its version is `4.5.15` or earlier in the WordPress plugins screen.
- Look for a theme or plugin that registers a `multi_media` field through the Redux Users API.

## Timeline

- 2026-10-30T18:55:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102918

## From the sources

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_