The Redux Framework plugin for WordPress contains a stored cross‑site scripting flaw, meaning that malicious script code can be permanently written to a page or component and executed whenever a user visits the affected content. This vulnerability arises from insufficient neutralization of input during web page generation. An attacker who can inject data that is later rendered by the plugin may be able to steal cookies, hijack sessions, or perform other actions as the site visitor.

The affected product is the Redux Framework plugin by David Anderson, used within WordPress sites. All versions up to and including 4.5.16 are vulnerable. The vulnerability is triggered through the plugin’s configuration or data entry mechanisms, which are available to users with access to the plugin UI.

The CVSS score of 6.5 indicates a medium severity impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves supplying malicious input via the Redux Framework’s option pages, which are typically accessible only to administrators. Once an attacker injects a malicious payload, it is stored and rendered on subsequent page loads, allowing the script to run in the browser context of any user viewing the affected content.