The Redux Framework plugin for WordPress is vulnerable to stored XSS through insufficient sanitization of the data parameter in all releases up to and including version 4.5.8. An attacker who can authenticate with Contributor privileges or higher can inject malicious scripts into site pages, and those scripts will run whenever another user views the affected page, enabling session hijacking, defacement, or phishing attempts. This weakness directly affects web‑application integrity and user confidentiality.

WordPress sites running the Redux Framework plugin, specifically any installation of versions 4.5.8 or earlier. The vendor identified in the CNA is davidanderson. No further version granularity is provided beyond the upper bound of 4.5.8.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1 % implies a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no active, widespread exploitation has been reported. Attackers would need to first gain contributor‑level access to the site; once that condition is met, the stored payload can be triggered by any page viewer. Given these constraints, the threat remains significant for sites with many contributors but is limited compared to remote code execution scenarios.