{"id":"CVE-2026-119472","kind":"vulnerability","aliases":["CVE-2026-119472"],"related":[],"title":"Redux Framework WordPress plugin: stored XSS through input handling","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16.","summary":"Redux Framework, a WordPress options framework used by theme and plugin developers, fails to neutralize some input before rendering it in a page. An attacker who can store content in the site can get script to run in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","redux-framework","self-hosted","wordpress"],"not_affected_if":["auth-required","no-redux-framework"],"how_to_check":"- Check the installed Redux Framework version in the WordPress plugins screen or the plugin header of `redux-framework.php`\n- Confirm whether the site or a theme bundles Redux Framework, since it can be embedded without being a standalone plugin","fix":"- Redux Framework: move to a version later than `4.5.16`; the source gives no exact fixed version","status":"open","published_at":"2026-11-06T08:17:18+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:36+00:00","updated_at":"2026-11-06T08:42:36+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-06T08:42:36Z","model":"claude-haiku-5-5","output":{"fix":"- Redux Framework: move to a version later than `4.5.16`; the source gives no exact fixed version","reach":"internet","title":"Redux Framework WordPress plugin: stored XSS through input handling","impact":"medium","summary":"Redux Framework, a WordPress options framework used by theme and plugin developers, fails to neutralize some input before rendering it in a page. An attacker who can store content in the site can get script to run in other users' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","redux-framework","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in admin browsers, enabling account takeover on the site","analyst_note":"Confirm the fixed version in the Redux Framework changelog or WPScan/NVD range and which privilege level is required to store the payload.","how_to_check":"- Check the installed Redux Framework version in the WordPress plugins screen or the plugin header of `redux-framework.php`\n- Confirm whether the site or a theme bundles Redux Framework, since it can be embedded without being a standalone plugin","plain_action":"","needs_analyst":true,"not_affected_if":["no-redux-framework","auth-required"],"who_is_affected":"Sites running Redux Framework 4.5.16 or earlier, including those where it is bundled inside a theme or plugin. The exposure depends on whether untrusted users can store content that is later rendered to other visitors or admins. Sites without Redux Framework can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4217,"output_tokens":571,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119472':12A,15A '-2026':11A,14A '4.5.16':96C 'affect':90C 'allow':86C 'anderson':80C 'attack':48B 'browser':64B 'content':52B 'cross':74C 'cross-sit':73C 'cve':10A,13A 'david':79C 'develop':35B 'fail':36B 'framework':2A,19B,25B,29B,82C,85C,92C 'generat':72C 'get':57B 'handl':9A 'host':22B 'improp':65C 'input':8A,40B,68C 'issu':89C 'n/a':94C 'neutral':38B,66C 'option':28B 'packag':16B 'page':46B,71C 'plugin':4A,34B 'redux':1A,18B,24B,81C,84C,91C 'redux-framework':17B,83C 'render':42B 'run':60B 'script':58B,76C 'self':21B 'self-host':20B 'site':55B,75C 'store':5A,51B,87C 'theme':32B 'use':30B 'user':63B 'vulner':77C 'web':70C 'wordpress':3A,23B,27B 'xss':6A 'xss.this':88C","nicknames":[],"mitigations":[],"who_affected":"Sites running Redux Framework 4.5.16 or earlier, including those where it is bundled inside a theme or plugin. The exposure depends on whether untrusted users can store content that is later rendered to other visitors or admins. Sites without Redux Framework can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","reduxframework","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119472':12A,15A '-2026':11A,14A 'cve':10A,13A 'framework':2A 'handl':9A 'input':8A 'plugin':4A 'redux':1A 'store':5A 'wordpress':3A 'xss':6A","search_b":"'attack':48B 'browser':64B 'content':52B 'develop':35B 'fail':36B 'framework':19B,25B,29B 'get':57B 'host':22B 'input':40B 'neutral':38B 'option':28B 'packag':16B 'page':46B 'plugin':34B 'redux':18B,24B 'redux-framework':17B 'render':42B 'run':60B 'script':58B 'self':21B 'self-host':20B 'site':55B 'store':51B 'theme':32B 'use':30B 'user':63B 'wordpress':23B,27B","search_c":"'4.5.16':96C 'affect':90C 'allow':86C 'anderson':80C 'cross':74C 'cross-sit':73C 'david':79C 'framework':82C,85C,92C 'generat':72C 'improp':65C 'input':68C 'issu':89C 'n/a':94C 'neutral':66C 'page':71C 'redux':81C,84C,91C 'redux-framework':83C 'script':76C 'site':75C 'store':87C 'vulner':77C 'web':70C 'xss.this':88C","first_public_at":"2026-11-06T08:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119472","severity":null,"published_at":"2026-11-06T08:17:18+00:00","modified_at":"2026-11-06T08:17:18+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}