CVE-2026-102918

24th percentile - higher than 24% of all known CVEs

The Redux Framework plugin for WordPress (versions up to and including 4.5.15) is vulnerable to stored cross-site scripting via the multi_media field. The field's renderer prints the stored value into an href attribute, a hidden input value, and an HTML element without escaping, and user_meta_save() checks permissions against a user ID from the request body, allowing a Subscriber to write a field declared for manage_options. An authenticated attacker with Subscriber-level access can inject arbitrary scripts into their own profile that execute when an administrator views that profile.

A low-privileged attacker can inject malicious scripts that execute in an administrator's browser, potentially leading to session hijacking or actions performed on behalf of the administrator. However, this requires a theme or plugin that registers a multi_media field through the Redux Users API.

Update the Redux Framework plugin to a version later than 4.5.15. Check whether used themes or plugins register multi_media fields through the Redux Users API and restrict their use if necessary.