CVE-2026-119472: WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability

Q: Which versions are affected?

Redux Framework versions through 4.5.16 are affected. The available information does not identify a fixed version.

Q: What type of impact does successful exploitation have?

The vulnerability allows stored cross-site scripting. Malicious input can be retained and later executed in a victim's browser when rendered in a web page.

Published Nov 6, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redux-framework to a version that resolves this vulnerability.
Fixed in 4.5.17

Event History

Nov 6, 2026

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which versions are affected?

Redux Framework versions through 4.5.16 are affected. The available information does not identify a fixed version.

What type of impact does successful exploitation have?

The vulnerability allows stored cross-site scripting. Malicious input can be retained and later executed in a victim's browser when rendered in a web page.

CVE-2026-119472: WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

Which versions are affected?

What type of impact does successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which versions are affected?

What type of impact does successful exploitation have?