SZB-a31f197d34
EUVD flags stored cross-site scripting in Redux Framework up to 4.5.15 (CVSS 6.4)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Redux Framework
- Product
- Redux Framework
- First seen
Summary
The EUVD (ENISA) database has published EUVD-2026-114225 for the Redux Framework WordPress plugin, versions up to and including 4.5.15. The entry says the multi_media field prints stored values into an href attribute, enabling stored cross-site scripting.
If you use Redux Framework
Update Redux Framework to a version newer than 4.5.15
Review plugin settings that use the multi_media field for injected links
Limit which admin users can edit theme and plugin options
What the sources say 1
· Mastodon: “The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field.” Source