{"id":"CVE-2026-102918","title":"Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id","summary":"The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attr…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"davidanderson","product":"Redux Framework","affected":["redux_framework <= 4.5.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T17:33:26.502115Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T18:08:58.237Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102918","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4d54e48-3a7f-4add-b842-6948377f2a73?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/multi_media/multi_media/class-redux-multi-media.php#L110"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/multi_media/multi_media/class-redux-multi-media.php#L147"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/users/class-redux-extension-users.php#L1010"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/users/class-redux-extension-users.php#L996"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3741037%40redux-framework%2Ftags%2F4.5.16&old=3705066%40redux-framework%2Ftags%2F4.5.15"},{"url":"https://plugins.trac.wordpress.org/changeset/3741037/redux-framework/trunk/redux-core/inc/extensions/multi_media/multi_media/class-redux-multi-media.php"}],"tags":["cve.org"],"epss":0.00312,"epssPercentile":0.24262,"ingestedAt":"2026-11-05T16:24:31.307Z","slug":"CVE-2026-102918","body":"## Overview\n\nThe Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API.\n\n## Affected\n\n- `redux_framework <= 4.5.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}