What’s Vulnerable › Products

davidanderson Redux Framework vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your davidanderson Redux Framework version is affected

Latest davidanderson Redux Framework vulnerabilities

• CVE-2026-103997 — Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript (CVSS 6.5)
• CVE-2026-102918 — Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id (CVSS 6.4)
• CVE-2025-14123 — Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension (CVSS 6.8)
• CVE-2026-90992 — Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field (CVSS 6.4)
• CVE-2026-88999 — Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter (CVSS 4.3)
• CVE-2026-5410 — Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input (CVSS 6.4)
• CVE-2026-5400 — Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input (CVSS 6.4)
• CVE-2026-5399 — Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value (CVSS 6.4)
• CVE-2025-9488 — Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter (CVSS 6.4)