CVE-2026-5400 Details

A stored cross-site scripting vulnerability has been identified in the Redux Framework plugin for WordPress, affecting versions through 4.5.13. This vulnerability arises from inadequate input sanitization of nested array values in the 'user_meta_save()' function, coupled with unsafe output of filter CSS values in the 'render()' function, which lacks proper escaping. As a result, authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages, which will execute when users access the affected page.

Users are advised to update the Redux Framework plugin to version 4.5.14 or later, where this vulnerability has been patched.