CVE-2026-5400 davidanderson CVE debrief

Who should care

WordPress site administrators and defenders should assess exposure and apply patches. Focus on user access controls and input validation to prevent exploitation. Also, consider reviewing compensating controls, monitoring for suspicious activity, and ensuring that security teams and vulnerability management processes are aware of the potential risks. This includes verifying that platform and operator security measures are in place to mitigate potential web

Why it matters

CVE-2026-5400 is a Stored Cross-Site Scripting vulnerability in the Redux Framework plugin for WordPress. It allows authenticated attackers with subscriber-level access to inject web scripts that execute when a user accesses an injected page. Defenders should assess exposure, prioritize patching, and strengthen input validation and output encoding.

• Defenders must verify if their WordPress sites use vulnerable versions of Redux Framework and prioritize patching.
• Site administrators need to ensure user access controls are in place to prevent unauthorized script injection.
• Input validation and output encoding must be reviewed and strengthened to prevent similar vulnerabilities.
• Monitoring for suspicious activity and injected scripts is crucial to detect potential exploitation.

Technical summary

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Media field filter values in versions up to, and including, 4.5.13. This is due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Defensive priority

Medium priority for WordPress site administrators and defenders to assess exposure and apply patches, focusing on user access controls and input validation.

Recommended defensive actions

• Assess exposure by checking if the installed version of Redux Framework is 4.5.13 or earlier.
• Verify user access controls to ensure only authorized users can inject scripts.
• Apply patches or updates to Redux Framework as soon as available.
• Monitor for suspicious activity and injected scripts on WordPress sites.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in Redux Framework versions up to 4.5.13. The issue involves insufficient sanitization of nested array values and unsafe output of filter CSS values. Official sources and references from Wordfence provide details on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.