{"id":"CVE-2026-102918","aliases":["EUVD-2026-114225","GHSA-29w8-v8g5-xh8g"],"status":"published","title":"Redux Framework \u003c= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id","description":"The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00312,"percentile":0.24464,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-10-30T17:15:29Z","modified":"2026-10-30T19:17:51Z","products":[{"vendor":"davidanderson","product":"redux framework"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4d54e48-3a7f-4add-b842-6948377f2a73?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/multi_media/multi_media/class-redux-multi-media.php#L110"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/multi_media/multi_media/class-redux-multi-media.php#L147"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/users/class-redux-extension-users.php#L1010"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/users/class-redux-extension-users.php#L996"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3741037%40redux-framework%2Ftags%2F4.5.16\u0026old=3705066%40redux-framework%2Ftags%2F4.5.15"},{"url":"https://plugins.trac.wordpress.org/changeset/3741037/redux-framework/trunk/redux-core/inc/extensions/multi_media/multi_media/class-redux-multi-media.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102918"},{"url":"https://github.com/advisories/GHSA-29w8-v8g5-xh8g"}],"sources":{"cve":[{"id":"CVE-2026-102918","title":"Redux Framework \u003c= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id","description":"The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API.","status":"published","published":"2026-10-30T17:15:29.717Z","modified":"2026-10-30T18:08:58.237Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:38:54.394896Z"}],"euvd":[{"id":"EUVD-2026-114225","description":"The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API.","status":"published","published":"2026-10-30T17:15:29Z","modified":"2026-10-30T18:08:58Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:03.071815Z"}],"ghsa":[{"id":"GHSA-29w8-v8g5-xh8g","title":"The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all...","description":"The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API.","status":"published","published":"2026-10-30T18:32:43Z","modified":"2026-10-30T18:32:52Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:14:52.01816Z"}],"nvd":[{"id":"CVE-2026-102918","description":"The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API.","status":"published","published":"2026-10-30T18:17:14.69Z","modified":"2026-10-30T19:17:51.883Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:13:05.268617Z"}]}}