CVE-2026-5400

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.14

Description Stored Cross-Site Scripting occurs via Media field filter values. The issue stems from insufficient input sanitization of nested array values in the user meta save() function and unsafe output of filter CSS values in the render() function without proper escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Recommendations Update Redux Framework to version 4.5.14 or later. As a temporary mitigation, restrict access to the user meta save() and render() functions for users with subscriber-level permissions.