The plugin is vulnerable because the content supplied for color scheme names is stored without proper sanitization or escaping. An authenticated user with subscriber privileges can store malicious markup in the color_scheme field so that, when a page that includes that field is rendered, the script runs in the browser of any visitor. The flaw provides code execution with the privileges of the user who views the page, potentially allowing phishing or credential theft, but it does not allow direct server‑side changes or data exfiltration.

WordPress sites that have installed Redux Framework versions 4.5.16 or older. The vulnerability exists only when the theme registers a color_scheme field via Redux_Users::set_profile(), which causes the setting to appear on the logged‑in user profile page. Any site running these plugin versions is therefore vulnerable.

The vulnerability carries a CVSS score of 6.4, indicating moderate severity. EPSS is currently not available, and the flaw is not listed in CISA’s KEV catalog, suggesting it is not known to be actively exploited in the wild, but the authenticated nature and absence of hard checks mean it is routine to test. An attacker needs only a subscription‑level user account and permission to edit their profile to insert malicious content, after which the infection spreads to anyone who views a page rendering the color scheme name. Because the capabilities are common for many users, the risk of exploitation is significant in environments where subscriber accounts exist.