CVE-2026-5410

Received Received - Intake

Stored XSS in Redux Framework WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, at line 56 of class-redux-spinner.php in the render() function, this value is rendered in an unquoted HTML attribute without escaping via '$data_string .= ' data-val=' . $this->value;'. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-5410

Affected Vendors & Products

Vendor	Product	Version / Range
redux_framework	redux_framework	to 4.5.13 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Redux Framework WordPress plugin affecting versions up to 4.5.13. It occurs due to insufficient input sanitization and output escaping in the spinner field. Attackers with subscriber-level access or higher can inject malicious scripts that are stored and later executed when users access affected pages.

Detection Guidance

This vulnerability requires checking WordPress installations for the Redux Framework plugin versions up to 4.5.13. Inspect plugin files for the spinner field in user_meta_save() and class-redux-spinner.php. Look for unquoted HTML attributes in rendered output. No direct commands are provided in the context.

Impact Analysis

An attacker could steal user sessions, redirect users to malicious sites, or perform actions on their behalf. This could lead to unauthorized access to sensitive data, defacement of websites, or installation of malware on visitor devices.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face fines, legal action, and reputational damage if user data is compromised through this exploit.

Mitigation Strategies

Update the Redux Framework plugin to the latest version, which should address the insufficient input sanitization and output escaping issues. If updating is not immediately possible, consider disabling the plugin temporarily until an update can be applied.

Hi! I’m here to help you understand CVE-2026-5410. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70