CVE-2026-90992— Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field
Quick assessment
Affected
davidanderson Redux Framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 Redux Framework 插件存在存储型跨站脚本（Stored XSS）漏洞，该漏洞源于对“user-mediaurl”媒体字段的用户元数据合并过程中输入清理不足以及输出转义不当，影响所有 4.5.14 及更早版本。 该漏洞允许拥有订阅者（Subscriber）级别或更高权限的已认证攻击者在页面中注入任意 Web 脚本，当用户访问被注入的页面时，这些脚本将被执行。 具体利用方式为：订阅者级别的用户可以将恶意载荷存储于用户元数据字段中，例如个人简介（biography）、会话令牌（ses
Possible ATT&CK Techniques 1 AI
T1059.007 · JavaScript
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90992
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field
Source: CVE Program / CVE List V5
Vulnerability Description
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users who can store a payload in user meta fields such as the biography, session_tokens (via a crafted User-Agent at login), or persisted_preferences (via the REST API), which are then promoted to the site-wide redux_demo option when a media URL repair is triggered on the demo panel.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| davidanderson | Redux Framework | 0 ~ 4.5.14 | - |
|
II. Public POCs for CVE-2026-90992
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90992
请登录查看更多情报信息。
Other References for CVE-2026-90992 (8)
IV. Related Vulnerabilities
Same product: Redux Framework
-
CVE-2026-88999
Redux Framework <= 4.5.14 - Missing Authorization to Authent -
CVE-2026-5410
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stor -
CVE-2026-5400
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cros -
CVE-2026-5399
Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) St -
CVE-2026-12525
Redux Framework < 4.5.13 - Subscriber+ Privilege Escalation
Same vendor: davidanderson
-
CVE-2026-88999
Redux Framework <= 4.5.14 - Missing Authorization to Authent -
CVE-2026-5410
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stor -
CVE-2026-5400
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cros -
CVE-2026-5399
Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) St -
CVE-2026-10795
UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauth
Same weakness: CWE-79
-
CVE-2026-103292
Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_hea -
CVE-2026-103277
Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEm -
CVE-2026-103249
n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via R -
CVE-2026-7176
Multiple vulnerabilities in Entradium by Crocantickets -
CVE-2026-7175
Multiple vulnerabilities in Entradium by Crocantickets
V. Comments for CVE-2026-90992
No comments yet