---
id: "CVE-2026-110534"
page: "https://infrastack.ai/live/CVE-2026-110534"
kind: "vulnerability"
aliases: ["CVE-2026-110534"]
title: "Redux Framework WordPress plugin: stored script injection via content parameter"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "redux-framework", "themes", "wordpress"]
not_affected_if: ["default-config", "no-set-profile-call"]
published_at: "2026-11-07T05:18:00+00:00"
first_seen_at: "2026-11-07T05:45:56+00:00"
updated_at: "2026-11-07T05:52:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110534", "first_seen_at": "2026-11-07T05:45:56+00:00"}]
exploit_sources: []
---

# Redux Framework WordPress plugin: stored script injection via content parameter

Link for people: https://infrastack.ai/live/CVE-2026-110534 (this .md is for agents)

The Redux Framework plugin for WordPress up to and including 4.5.16 does not sanitize or escape the 'content' parameter, so stored script can be saved and later run in the browser of anyone who opens the injected page. An attacker with a Subscriber account can plant that script, and it runs for other users such as administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Redux Framework version in the WordPress plugin list or in the plugin's header in `wp-content/plugins/redux-framework/`, and compare it with `4.5.16`.
- Check whether the theme calls `Redux_Users::set_profile()` to register a color_scheme field on user profiles.

## Fix

- Redux Framework: unknown (the sources do not name a fixed version).

## Timeline

- 2026-11-07T05:45:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110534

## From the sources

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the target site's theme to register a color_scheme field on the user profile via Redux_Users::set_profile(), which causes the nonce to be rendered on /wp-admin/profile.php for every logged-in user, making it accessible to Subscribers.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_