rootpwn

medium · CVSS v3 6.4

CVE-2026-90992

The Redux Framework plugin for WordPress is vulnerable to stored XSS via user meta merge. Authenticated users with Subscriber role can injec

Overview

The Redux Framework plugin for WordPress is vulnerable to stored XSS via user meta merge. Authenticated users with Subscriber role can inject scripts that execute on site pages. This can lead to defacement or credential theft.

Description

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users who can store a payload in user meta fields such as the biography, session_tokens (via a crafted User-Agent at login), or persisted_preferences (via the REST API), which are then promoted to the site-wide redux_demo option when a media URL repair is triggered on the demo panel.

Impact

Confidentiality: attackers can steal session cookies. Integrity: site content can be altered. Availability: minimal. Defenders: site admins, developers, security teams.

Remediation

Upgrade Redux Framework to version 4.5.15 or later. If upgrade not possible, restrict Subscriber role from editing user meta fields or disable media URL repair feature. Apply input sanitization on user-meta fields and escape output.

Risk context

Medium severity; no EPSS data; recommend prompt patching.

Affected products

  • WordPress
  • Redux Framework plugin
  • Redux Framework 4.5.14

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
6.4
CVSS v4
—
EPSS
—

XSS WordPress Redux Stored XSS User Meta Subscriber Defacement

← All CVEs

Related CVEs

medium

CVE-2026-103542

Form Tools up to 3.1.1 contains a server‑side request forgery vulnerability in the smart_fill function. An attacker can supply a crafted URL to the AJAX endpoint, causing the server to fetch arbitrary resources. This flaw can be triggered remotely without authentication.

View analysis

medium

CVE-2026-97251

CVE-2026-97251 is an unauthenticated Insecure Direct Object Reference vulnerability in Bus Ticket Booking with Seat Reservation versions 5.9.3 and earlier. It matters because it may allow unauthorized access to booking or seat reservation data if object references are not properly authorized.

View analysis

medium

CVE-2026-97258

CVE-2026-97258 is a medium-severity broken access control issue in Aruba Migration Tool versions 1.0.4 and earlier. It may allow unauthorized access to subscriber-related functionality or data if the tool is exposed or improperly configured. It matters because migration tools can contain sensitive configuration, credentials, or network-management data.

View analysis

medium

CVE-2026-97269

WPFunnels versions 3.13.1 and earlier contain an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in a WordPress plugin. It may allow unauthorized access to objects or records if object identifiers are predictable or exposed. It matters because WordPress sites using the plugin could suffer data exposure or unauthorized changes.

View analysis