CVE-2026-5410 in Redux Framework Plugin
Summary
by MITRE • 09/19/2026
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, at line 56 of class-redux-spinner.php in the render() function, this value is rendered in an unquoted HTML attribute without escaping via '$data_string .= ' data-val=' . $this->value;'. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The Redux Framework plugin for WordPress contains a critical security vulnerability affecting versions up to and including 4.5.13, specifically manifesting as a Stored Cross-Site Scripting flaw within the spinner field component. This vulnerability arises from insufficient input sanitization and output escaping mechanisms embedded in the plugin's core logic. The root cause lies in the user_meta_save function, which is responsible for handling data persistence to WordPress user metadata. In this specific implementation, the sanitization logic is designed exclusively to process array-type inputs. However, attackers can exploit a type-juggling weakness by submitting scalar values instead of arrays. This bypasses the intended validation checks because the code fails to recognize or sanitize non-array input types, allowing malicious payloads to be stored directly in user meta fields without any filtering or encoding applied at the point of entry.
Once the malicious payload is successfully stored in the database via this sanitization bypass, it remains dormant until triggered by a specific rendering event. The vulnerability materializes during the output phase when the class-redux-spinner.php file executes its render function, specifically around line 56. In this context, the previously injected value is concatenated into an HTML attribute string using the syntax data-val= followed directly by the unescaped user-controlled value. Because the value is rendered within an HTML attribute without proper quoting or escaping, any special characters included in the payload are interpreted as part of the DOM structure rather than literal text content. This structural flaw allows for the injection of arbitrary JavaScript code that becomes part of the page's executable script stream whenever the affected component is rendered to a user's browser.
The operational impact of this vulnerability is significant due to its stored nature and low privilege requirement. Unlike reflected XSS attacks which require tricking users into clicking malicious links, Stored Cross-Site Scripting persists on the server side, meaning every user who views a page containing the compromised spinner field will have their session exposed to the injected script. The attack vector requires authenticated access with subscriber-level permissions or higher, making it accessible to any registered user of the WordPress site. Once executed, the malicious scripts can perform actions such as stealing administrative cookies and session tokens, hijacking user sessions, performing unauthorized actions on behalf of victims, defacing websites, or redirecting users to phishing sites. This effectively compromises the confidentiality and integrity of all users interacting with the affected pages, potentially leading to full site compromise if an administrator's credentials are stolen through this vector.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves insufficient sanitization at input and lack of escaping at output, which corresponds to CWE-601 URL Redirection to Untrusted Site or CWE-829 Inclusion of Functionality from Untrusted Control. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic TA0005 Defense Evasion and specifically sub-technique T1059 Command Line Interface if scripts are used for further execution, but more accurately falls under T1189 Drive-by Client Side Execution where malicious code is delivered via a compromised web page. The persistence of the payload in user meta also relates to TA0003 Persistence as it allows long-term access without re-injection.
Mitigation strategies should focus on immediate remediation and future prevention. Administrators must upgrade the Redux Framework plugin to version 4.5.14 or later, where these sanitization logic gaps have been addressed by developers to properly handle scalar inputs and enforce strict output escaping for all HTML attributes. In environments where upgrading is not immediately feasible, a temporary workaround involves restricting user registration capabilities or disabling public access to areas of the site that utilize the spinner field component until patches are applied. Additionally, implementing a Web Application Firewall with rulesets tuned to detect XSS payloads in form submissions and URL parameters can provide an additional layer of defense by blocking malicious inputs before they reach the application logic. Regular security audits focusing on input validation and output encoding practices across all custom plugins are essential to prevent similar vulnerabilities from being introduced into WordPress ecosystems.