CVE-2026-102918

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.16

Description Stored Cross-Site Scripting occurs via the multi media field because the renderer prints stored values into an href attribute, a hidden input value, and an HTML element without proper escaping. This is further exacerbated by the user meta save() function in Redux Extension Users, which validates permissions using the checkuser id variable from the request body instead of the current authenticated user. Consequently, users with Subscriber-level access can modify fields intended for manage options permissions. This allows authenticated attackers to inject arbitrary web scripts into their profile records, which then execute when an administrator views the profile in the dashboard. This issue requires a theme or plugin that registers a multi media field through the Redux Users API.

Recommendations Update to version 4.5.16 or later. As a temporary mitigation, restrict the use of the multi media field through the Redux Users API.