Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

Redux Framework — Vulnerabilities & Security Advisories 14

All 14 CVE vulnerabilities found in Redux Framework, with AI-generated Chinese analysis, references, and POCs.

Vendor: davidanderson

CVE ID Title CVSS Severity Published
CVE-2026-120533 Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile CWE-79 6.4 Medium 2026-11-05
CVE-2026-104812 Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key CWE-79 6.4 Medium 2026-11-05
CVE-2026-103997 Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript CWE-862 6.5 Medium 2026-10-31
CVE-2026-102918 Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id CWE-79 6.4 Medium 2026-10-30
CVE-2026-116404 WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability CWE-862 6.5 Medium 2026-10-28
CVE-2025-14123 Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension CWE-269 6.8 Medium 2026-10-09
CVE-2026-90992 Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field CWE-79 6.4 Medium 2026-10-01
CVE-2026-88999 Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter CWE-862 4.3 Medium 2026-10-01
CVE-2026-5410 Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input CWE-79 6.4 Medium 2026-09-19
CVE-2026-5400 Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input CWE-79 6.4 Medium 2026-09-19
CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value CWE-79 6.4 Medium 2026-09-10
CVE-2026-12525 Redux Framework < 4.5.13 - Subscriber+ Privilege Escalation to Administrator - - 2026-07-16
CVE-2025-9488 Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter CWE-79 6.4 Medium 2025-12-13
CVE-2024-6828 Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting CWE-434 7.2 High 2024-07-23

All 14 known CVE vulnerabilities affecting Redux Framework with full Chinese analysis, references, and POCs where available.