A stored cross‑site scripting flaw exists in the Redux Framework WordPress plugin, specifically in the multi_media field renderer. The renderer injects user input into an href attribute, a hidden input and an HTML element without escaping, while surrounding attributes are escaped. Coupled with a permission check that mistakenly uses a request‑supplied user id (checkuser_id) instead of the current user, a Subscriber‑level or higher user can supply malicious scripts that are stored in the profile. When an administrator views that profile in the dashboard, the script runs in the admin context, enabling the attacker to execute arbitrary code. This stored XSS vulnerability corresponds to CWE‑79.

All releases of the Redux Framework plugin by davidanderson, version 4.5.15 and earlier, are vulnerable when installed as a WordPress plugin, provided that a theme or plugin registers at least one multi_media field via the Redux Users API. Sites running Redux Framework 4.5.16 or later are not affected.

The CVSS v3.1 score of 6.4 indicates moderate severity. Exploitation requires only an authenticated account with Subscriber or higher role. The attacker can store a payload that will be executed when an administrator inspects the profile, effectively granting script execution in the admin interface. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, yet the straightforward authentication prerequisite means the risk is significant for affected WordPress installations.