CVE-2026-5399: Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave() function (which only sanitizes array values, not scalar values) and improper output escaping in the ReduxSlider::render() method, which outputs slider values into unquoted HTML attributes. The vulnerability also exploits the fact that the cleandefault() method only casts values to numeric types when they are empty or out of bounds, allowing malicious strings like '1 tabindex=0 autofocus onfocus=alert(1) x=' to pass validation through PHP's loose type comparison. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their user profile that will execute whenever an Administrator navigates to view the attacker's profile page.
Affected Software
Event History
Frequently Asked Questions
Which users can carry out the attack, and what must happen for the payload to run?
An attacker needs an authenticated WordPress account with Subscriber-level access or higher. The injected script runs when an Administrator views the attacker's profile page.
Which installations should be considered exposed?
Redux Framework versions up to and including 4.5.13.1 are affected. The vulnerable path involves Slider fields in User Profile settings.
How can administrators look for possible exploitation?
Review user-profile Slider field values for unexpected non-numeric content, especially text resembling injected HTML attributes or event handlers. Malicious values are stored in the attacker's user profile and are triggered when that profile is viewed by an Administrator.