Davidanderson Redux Framework vulnerabilities

• davidanderson redux framework Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name CVE-2026-110534 6.4 MediumNovember 7, 2026
• davidanderson redux framework Redux Framework <= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action CVE-2026-110705 5.3 MediumNovember 7, 2026
• david anderson redux framework WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability CVE-2026-119472 6.5 MediumNovember 6, 2026
• davidanderson redux framework Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile CVE-2026-120533 6.4 MediumNovember 5, 2026
• davidanderson redux framework Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key CVE-2026-104812 6.4 MediumNovember 5, 2026
• davidanderson redux framework Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript CVE-2026-103997 6.5 MediumOctober 31, 2026
• davidanderson redux framework Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id CVE-2026-102918 6.4 MediumOctober 30, 2026
• david anderson redux framework WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability CVE-2026-116404 6.5 MediumOctober 28, 2026
• davidanderson redux framework Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension CVE-2025-14123 6.8 MediumOctober 9, 2026
• davidanderson redux framework Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field CVE-2026-90992 6.4 MediumOctober 1, 2026
• davidanderson redux framework Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter CVE-2026-88999 4.3 MediumOctober 1, 2026
• davidanderson redux framework Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input CVE-2026-5410 6.4 MediumSeptember 19, 2026
• davidanderson redux framework Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input CVE-2026-5400 6.4 MediumSeptember 19, 2026
• davidanderson redux framework Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value CVE-2026-5399 6.4 MediumSeptember 10, 2026
• davidanderson redux framework Redux Framework < 4.5.13 - Subscriber+ Privilege Escalation to Administrator CVE-2026-12525 8.8 HighJuly 16, 2026
• davidanderson redux framework Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter CVE-2025-9488 6.4 MediumDecember 13, 2025
• davidanderson redux framework, redux gutenberg template library \& redux framework +1 more Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting CVE-2024-6828 7.2 HighJuly 23, 2024