CVE-2026-5399 in Redux Framework Plugin
Summary
by MITRE • 09/10/2026
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user_meta_save() function (which only sanitizes array values, not scalar values) and improper output escaping in the Redux_Slider::render() method, which outputs slider values into unquoted HTML attributes. The vulnerability also exploits the fact that the clean_default() method only casts values to numeric types when they are empty or out of bounds, allowing malicious strings like '1 tabindex=0 autofocus onfocus=alert(1) x=' to pass validation through PHP's loose type comparison. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their user profile that will execute whenever an Administrator navigates to view the attacker's profile page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/10/2026
The Redux Framework plugin for WordPress contains a critical stored cross-site scripting vulnerability affecting versions up to 4.5.13.1. This flaw resides within the Slider field component of the User Profile settings, allowing authenticated attackers with Subscriber-level access or higher to inject malicious JavaScript payloads into their user profiles. The attack vector relies on the attacker modifying specific profile fields that are processed by the Redux framework before being stored in the WordPress database and subsequently rendered back to administrators. Because the payload is stored server-side, it persists until removed, creating a persistent threat whenever an administrator views the compromised account's details.
The technical root cause of this vulnerability stems from insufficient input sanitization within the user_meta_save function. This function fails to properly sanitize scalar values, focusing only on array structures and leaving individual string inputs exposed. Furthermore, the validation logic in the clean_default method exhibits a dangerous reliance on PHP loose type comparison when handling numeric fields. By providing a malicious string such as 1 tabindex=0 autofocus onfocus=alert(1) x=, an attacker can exploit the fact that this value starts with a digit and is therefore cast to a number during validation checks for empty or out-of-bounds conditions. This casting process effectively strips away the security boundaries intended by the framework, allowing arbitrary HTML attributes and event handlers to bypass input filters and be stored in the database without alteration.
The exploitation phase occurs when an administrator navigates to view the attacker's user profile page. The Redux_Slider::render method is responsible for displaying these saved values but fails to implement proper output escaping. Specifically, it outputs the slider value directly into unquoted HTML attributes within the generated markup. This lack of encoding allows the stored JavaScript payload to be interpreted by the browser as executable code rather than static text. When combined with injected event handlers like onfocus or onclick, the malicious script executes in the context of the administrator's session, granting the attacker significant leverage over the victim's environment.
The operational impact of this vulnerability is severe due to its stored nature and low privilege requirement for exploitation. An attacker needs only basic Subscriber-level access, which is often granted by default to new users or content contributors on many WordPress sites. Once executed, the cross-site scripting attack can lead to session hijacking through cookie theft, allowing the attacker to impersonate the administrator. It also enables keylogging, credential harvesting from forms viewed during the session, and potentially further lateral movement within the network if administrative functions are accessed via the compromised browser context. This represents a significant risk to site integrity and data confidentiality.
To mitigate this vulnerability, administrators should immediately update the Redux Framework plugin to version 4.5.13.2 or later where these sanitization and escaping issues have been addressed. Until an upgrade is possible, it is advisable to restrict user registration capabilities if feasible, ensuring that only trusted individuals can create accounts with profile-editing privileges. Additionally, implementing a Web Application Firewall with rules targeting common XSS payloads in user meta fields may provide temporary protection against exploitation attempts. Security teams should also audit existing user profiles for any suspicious script injections and remove them manually while monitoring administrator activity logs for signs of compromise following the vulnerability's disclosure.
This incident aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack methodology corresponds to MITRE ATT&CK technique T1059, specifically Command and Scripting Interpretation via JavaScript execution in a browser context. Understanding these mappings helps security professionals categorize the risk accurately within broader threat intelligence frameworks and prioritize remediation efforts based on standardized classification systems rather than isolated vendor advisories alone.