CVE-2026-104812 Details

A stored cross-site scripting vulnerability has been identified in the Redux Framework plugin for WordPress, affecting all versions. The issue arises from inadequate input sanitization and output escaping, particularly in the 'multi_media' field array key. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary scripts into pages, which are executed when users access the affected page. The problem stems from the wp_kses_post sanitization, which only applies to array leaf values, leaving array keys unsanitized. Consequently, injected keys are rendered directly into an HTML attribute without proper escaping, facilitating attribute breakout.

Users are advised to update the Redux Framework plugin to version 4.5.17 or a newer patched version.