{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-102918","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","state":"PUBLISHED","assignerShortName":"Wordfence","dateReserved":"2026-09-29T19:07:43.153Z","datePublished":"2026-10-30T17:15:29.717Z","dateUpdated":"2026-10-30T18:08:58.237Z"},"containers":{"cna":{"providerMetadata":{"orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence","dateUpdated":"2026-10-30T17:15:29.717Z"},"affected":[{"vendor":"davidanderson","product":"Redux Framework","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.5.15","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API."}],"title":"Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4d54e48-3a7f-4add-b842-6948377f2a73?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/multi_media/multi_media/class-redux-multi-media.php#L110"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/multi_media/multi_media/class-redux-multi-media.php#L147"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/users/class-redux-extension-users.php#L1010"},{"url":"https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.5.15/redux-core/inc/extensions/users/class-redux-extension-users.php#L996"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3741037%40redux-framework%2Ftags%2F4.5.16&old=3705066%40redux-framework%2Ftags%2F4.5.15"},{"url":"https://plugins.trac.wordpress.org/changeset/3741037/redux-framework/trunk/redux-core/inc/extensions/multi_media/multi_media/class-redux-multi-media.php"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-79 Improper Neutralization of Input During Web Page Generation","cweId":"CWE-79","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM"}}],"credits":[{"lang":"en","type":"finder","value":"Md. Moniruzzaman Prodhan (NomanProdhan)"}],"timeline":[{"time":"2026-09-29T19:27:10.000Z","lang":"en","value":"Vendor Notified"},{"time":"2026-10-30T13:52:46.000Z","lang":"en","value":"Disclosed"}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102918","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-30T17:33:26.502115Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-30T18:08:58.237Z"}}]}}