davidanderson Redux Framework

• CVE-2026-110534 Medium 6.4 Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name –
• CVE-2026-110705 Medium 5.3 Redux Framework <= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action –
• CVE-2026-120533 Medium 6.4 Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile 0.3%
• CVE-2026-104812 Medium 6.4 Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key 0.2%
• CVE-2026-103997 Medium 6.5 Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript 0.3%
• CVE-2026-102918 Medium 6.4 Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id 0.3%
• CVE-2025-14123 Medium 6.8 Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension 0.2%
• CVE-2026-90992 Medium 6.4 Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field 0.2%
• CVE-2026-88999 Medium 4.3 Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter 0.3%
• CVE-2026-5410 Medium 6.4 Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input 0.4%
• CVE-2026-5400 Medium 6.4 Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input 0.4%
• CVE-2026-5399 Medium 6.4 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value 0.3%
• CVE-2025-9488 Medium 6.4 Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter 0.3%
• CVE-2024-6828 High 7.2 Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting 1.0%