WordPress security changelog
MEDIUM CVE-2026-5410 Deferred

Redux spinner user metadata escapes into an unquoted HTML attribute

A Subscriber or higher role submits a scalar spinner value. user_meta_save() only sanitizes arrays, leaving that scalar stored unfiltered. The spinner render() method in class-redux-spinner.php then places it in an unquoted data-val attribute, permitting stored script when the affected UI is viewed. The exact save route is not disclosed. Authoritative affected range: <= 4.5.13. No fixed release is confirmed in this review.

CVE / CNA score 6.4 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Redux Framework
Plugin slug
redux-framework
Affected
<= 4.5.13
Safe version
See mitigation notes
Published
Sep 19, 2026
Weakness
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This CVE was published Sep 19, 2026 and is one of 7 known issues for this plugin.

What to do

Update, patch or deactivate.

No confirmed fixed release. The 4.5.14 XSS note does not identify the spinner scalar path; 4.5.15 names a different media URL issue. No matching fixed version is confirmed. Official changelog: https://wordpress.org/plugins/redux-framework/#developers . Validate scalar and array field values, enforce a numeric spinner schema, and quote and escape every rendered attribute. Restrict affected profile fields and clean malicious user metadata until updated.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, at line 56 of class-redux-spinner.php in the render() function, this value is rendered in an unquoted HTML attribute without escaping via '$data_string .= ' data-val=' . $this->value;'. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

Primary and upstream sources