Security Alert Summary
The Redux Framework plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the Slider field on user profile settings. Authenticated users with Subscriber-level access and above can inject script payloads into their profile slider value that execute when an Administrator views the attacker’s profile.
CVE Details
- CVE ID: CVE-2026-5399
- Affected component: Redux Framework plugin (User Profile Slider field)
- Affected versions: Versions up to and including 4.5.13.1
- Published: September 10, 2026, 10:17:31 AM
- Last modified: September 10, 2026, 2:39:13 PM
- CVSS v3.1 base score: 6.4 (MEDIUM)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Privileges required: Low (authenticated user, Subscriber-level and above)
- User interaction: None
- Attack vector: Network
- Scope: Changed
- Impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation, aka Cross-site Scripting)
Technical Details
This vulnerability is a stored XSS originating from insufficient input sanitization and improper output escaping in Redux Framework’s user profile slider handling. The plugin’s user_meta_save() function sanitizes array values but does not properly sanitize scalar values. The slider rendering in Redux_Slider::render() outputs slider values into unquoted HTML attributes without adequate escaping.
The plugin’s clean_default() method further contributes to the issue by casting values to numeric types only when they are empty or out of bounds. Because of PHP’s loose type comparison, malicious strings such as 1 tabindex=0 autofocus onfocus=alert(1) x= can bypass validation and be stored. When an Administrator views the attacker’s profile page, the injected attribute payload executes in the Administrator’s browser context.
The flaw is a classic stored XSS limited to contexts where profile fields are rendered into HTML attributes without quotes and without proper escaping. The impact is the execution of arbitrary script in the context of privileged users who view the affected profile page.
How This Could Impact Your Website
Consider a site with multiple WordPress users: a site owner, several internal staff members with Editor privileges, and external contributors or contractors with Subscriber or Contributor accounts. A malicious authenticated Subscriber could add a specially crafted value to their profile slider field. When an Administrator or privileged staff member visits that user profile, the injected script runs in the administrator’s browser.
Practical consequences include exposure of internal profile data visible to the administrator, disclosure of internal user email addresses, and increased risk of targeted phishing or social engineering attacks using information gathered via the injected script. The attack does not imply full site compromise on its own, but it can be used to escalate further social-engineering or data-exfiltration efforts against privileged users.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Subscriber/Contributor accounts that can edit profile fields.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and administrator sessions for unusual behavior when viewing user profiles.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/reduxframework/redux-framework/pull/4112/changes
- https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018
- https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.10/redux-core/inc/fields/slider/class-redux-slider.php#L311
- https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/extensions/users/class-redux-extension-users.php#L1018
- https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/fields/slider/class-redux-slider.php#L311
- https://www.wordfence.com/threat-intel/vulnerabilities/id/31c554cf-eee9-45a8-8fb6-198978620204?source=cve
