CVE-2026-102918 Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multimedia field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without...

CVE-2026-102918

The Redux Framework plugin for WordPress (versions up to and including 4.5.15 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the multi_media field. The root cause is the field's renderer printing stored values into an href attribute, a hidden input value, and an HTML element without pro...