{"id":"CVE-2026-110534","kind":"vulnerability","aliases":["CVE-2026-110534"],"related":[],"title":"Redux Framework WordPress plugin: stored script injection via content parameter","description":"The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the target site's theme to register a color_scheme field on the user profile via Redux_Users::set_profile(), which causes the nonce to be rendered on /wp-admin/profile.php for every logged-in user, making it accessible to Subscribers.","summary":"The Redux Framework plugin for WordPress up to and including 4.5.16 does not sanitize or escape the 'content' parameter, so stored script can be saved and later run in the browser of anyone who opens the injected page. An attacker with a Subscriber account can plant that script, and it runs for other users such as administrators.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","redux-framework","themes","wordpress"],"not_affected_if":["default-config","no-set-profile-call"],"how_to_check":"- Check the installed Redux Framework version in the WordPress plugin list or in the plugin's header in `wp-content/plugins/redux-framework/`, and compare it with `4.5.16`.\n- Check whether the theme calls `Redux_Users::set_profile()` to register a color_scheme field on user profiles.","fix":"- Redux Framework: unknown (the sources do not name a fixed version).","status":"open","published_at":"2026-11-07T05:18:00+00:00","first_seen_at":"2026-11-07T05:45:56+00:00","triaged_at":"2026-11-07T05:52:46+00:00","updated_at":"2026-11-07T05:52:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T05:52:46Z","model":"claude-haiku-5-5","output":{"fix":"- Redux Framework: unknown (the sources do not name a fixed version).","reach":"internet","title":"Redux Framework WordPress plugin: stored script injection via content parameter","impact":"medium","summary":"The Redux Framework plugin for WordPress up to and including 4.5.16 does not sanitize or escape the 'content' parameter, so stored script can be saved and later run in the browser of anyone who opens the injected page. An attacker with a Subscriber account can plant that script, and it runs for other users such as administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","redux-framework","themes"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Script runs in other users' browsers, possibly administrators, on page view.","analyst_note":"Confirm the fixed version of Redux Framework after 4.5.16 from the WordPress plugin page or the NVD entry.","how_to_check":"- Check the installed Redux Framework version in the WordPress plugin list or in the plugin's header in `wp-content/plugins/redux-framework/`, and compare it with `4.5.16`.\n- Check whether the theme calls `Redux_Users::set_profile()` to register a color_scheme field on user profiles.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","no-set-profile-call"],"who_is_affected":"Sites running Redux Framework 4.5.16 or earlier are exposed only when the active theme registers a color_scheme profile field through Redux_Users::set_profile(), which makes the nonce visible on profile.php to Subscribers. Sites without that theme code, or with a patched plugin, can skip it. Anyone who can create a Subscriber account on an affected site can exploit it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000763,"input_tokens":4351,"output_tokens":655,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110534':13A,16A '-2026':12A,15A '/wp-admin/profile.php':175C '4.5.16':33B,105C 'access':125C,141C,184C 'account':66B 'administr':79B 'anyon':55B 'arbitrari':130C 'attack':62B,120C 'authent':119C 'browser':53B 'caus':168C 'color':155C 'content':9A,40B,96C 'cross':91C 'cross-sit':90C 'cve':11A,14A 'due':106C 'escap':38B,113C 'everi':177C 'execut':137C 'field':157C 'framework':2A,20B,25B,82C 'includ':32B,104C 'inject':7A,59B,129C,143C 'input':109C 'insuffici':108C 'later':49B 'level':124C 'log':179C 'logged-in':178C 'make':115C,182C 'nonc':170C 'open':57B 'output':112C 'packag':17B 'page':60B,134C,144C 'paramet':10A,41B,97C 'plant':68B 'plugin':4A,26B,83C 'possibl':117C 'profil':161C,166C 'redux':1A,19B,24B,81C,163C 'redux-framework':18B 'regist':153C 'render':173C 'requir':146C 'run':50B,73B 'sanit':36B,110C 'save':47B 'scheme':156C 'script':6A,44B,70B,93C,132C 'set':165C 'site':92C,149C 'store':5A,43B,89C 'subscrib':65B,123C,186C 'subscriber-level':122C 'target':148C 'theme':21B,151C 'user':76B,140C,160C,164C,181C 'version':100C 'via':8A,94C,162C 'vulner':87C 'web':131C 'whenev':138C 'wordpress':3A,22B,28B,85C","nicknames":[],"mitigations":[],"who_affected":"Sites running Redux Framework 4.5.16 or earlier are exposed only when the active theme registers a color_scheme profile field through Redux_Users::set_profile(), which makes the nonce visible on profile.php to Subscribers. Sites without that theme code, or with a patched plugin, can skip it. Anyone who can create a Subscriber account on an affected site can exploit it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","reduxframework","themes","wordpress"],"campaign_type":null,"search_a":"'-110534':13A,16A '-2026':12A,15A 'content':9A 'cve':11A,14A 'framework':2A 'inject':7A 'paramet':10A 'plugin':4A 'redux':1A 'script':6A 'store':5A 'via':8A 'wordpress':3A","search_b":"'4.5.16':33B 'account':66B 'administr':79B 'anyon':55B 'attack':62B 'browser':53B 'content':40B 'escap':38B 'framework':20B,25B 'includ':32B 'inject':59B 'later':49B 'open':57B 'packag':17B 'page':60B 'paramet':41B 'plant':68B 'plugin':26B 'redux':19B,24B 'redux-framework':18B 'run':50B,73B 'sanit':36B 'save':47B 'script':44B,70B 'store':43B 'subscrib':65B 'theme':21B 'user':76B 'wordpress':22B,28B","search_c":"'/wp-admin/profile.php':175C '4.5.16':105C 'access':125C,141C,184C 'arbitrari':130C 'attack':120C 'authent':119C 'caus':168C 'color':155C 'content':96C 'cross':91C 'cross-sit':90C 'due':106C 'escap':113C 'everi':177C 'execut':137C 'field':157C 'framework':82C 'includ':104C 'inject':129C,143C 'input':109C 'insuffici':108C 'level':124C 'log':179C 'logged-in':178C 'make':115C,182C 'nonc':170C 'output':112C 'page':134C,144C 'paramet':97C 'plugin':83C 'possibl':117C 'profil':161C,166C 'redux':81C,163C 'regist':153C 'render':173C 'requir':146C 'sanit':110C 'scheme':156C 'script':93C,132C 'set':165C 'site':92C,149C 'store':89C 'subscrib':123C,186C 'subscriber-level':122C 'target':148C 'theme':151C 'user':140C,160C,164C,181C 'version':100C 'via':94C,162C 'vulner':87C 'web':131C 'whenev':138C 'wordpress':85C","first_public_at":"2026-11-07T05:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110534","severity":null,"published_at":"2026-11-07T05:18:00+00:00","modified_at":"2026-11-07T05:18:00+00:00","first_seen_at":"2026-11-07T05:45:56+00:00","fetched_at":"2026-11-07T05:45:56+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}