CVE-2026-119472 · Package
NO FIX YET · SEE WHAT TO DO
Redux Framework, a WordPress options framework used by theme and plugin developers, fails to neutralize some input before rendering it in a page. An attacker who can store content in the site can get script to run in other users' browsers.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running Redux Framework 4.5.16 or earlier, including those where it is bundled inside a theme or plugin. The exposure depends on whether untrusted users can store content that is later rendered to other visitors or admins. Sites without Redux Framework can skip it.
Not affected if auth-required, no-redux-framework
Who cares redux-framework, self-hosted, wordpress
redux-framework.php4.5.16; the source gives no exact fixed versionImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.