CVE-2026-90992

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.15

Description Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access and above to perform Stored Cross-Site Scripting. Attackers can inject arbitrary web scripts into pages by storing a payload in user meta fields such as the biography, session tokens (via a crafted User-Agent at login), or persisted preferences (via the REST API). These payloads are promoted to the site-wide redux demo option when a media URL repair is triggered on the demo panel via the user-mediaurl Media Field.

Recommendations Update Redux Framework to version 4.5.15 or later.