CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
Authenticated attackers can inject scripts into user profiles via slider fields, executing code when administrators view the profile.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-5399?
CVE-2026-5399 is a medium-severity cross-site scripting vulnerability in davidanderson Redux Framework, published on 10 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user_meta_save() function (which only sanitizes array values, not scalar values) and improper output escaping in the Redux_Slider::render() method, which outputs slider values into unquoted HTML attributes. The vulnerability also exploits the fact that the clean_default() method only casts values to numeric types when they are empty or out of bounds, allowing malicious strings like '1 tabindex=0 autofocus onfocus=alert(1) x=' to pass validation through PHP's loose type comparison. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their user profile that will execute whenever an Administrator navigates to view the attacker's profile page.
Weakness: CWE-79
Which versions are affected by CVE-2026-5399?
How do I fix CVE-2026-5399?
No fix has been published for CVE-2026-5399 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-5399 being exploited?
There is no known exploitation of CVE-2026-5399 in the wild and no public exploit code.
Sources
Also known as GHSA-hvw8-fmqf-2f96.