CVE-2026-5410 davidanderson CVE debrief

Who should care

Defenders of WordPress installations using the Redux Framework plugin, especially those with subscriber-level access and above, should assess exposure and prioritize updates or mitigations.

Why it matters

CVE-2026-5410 allows authenticated attackers to inject scripts, impacting WordPress sites using Redux Framework plugin versions up to 4.5.13.

• Authenticated attackers can inject arbitrary web scripts.
• Injected scripts execute when a user accesses an injected page.
• Requires verification of affected versions and remediation status.

Technical summary

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13. This is due to insufficient input sanitization and output escaping in the user_meta_save() function and the render() function in class-redux-spinner.php. The vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue requires verification of affected versions and remediation status. Defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Medium priority for defenders of WordPress installations using the Redux Framework plugin, especially those with subscriber-level access and above.

Recommended defensive actions

• Update the Redux Framework plugin to a version beyond 4.5.13.
• Restrict access to the WordPress installation for users with subscriber-level access and above.
• Monitor pages for injected scripts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability allows authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue arises from the user_meta_save() function and the render() function in class-redux-spinner.php.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.