The Redux Framework plugin for WordPress is vulnerable to stored cross‑site scripting via the slider field in user profile settings. Insufficient sanitization in user_meta_save() and improper escaping in the rendering method allow malicious strings such as "1 tabindex=0 autofocus onfocus=alert(1) x=" to be stored. An authenticated user with Subscriber or higher privileges can inject arbitrary JavaScript that will run whenever an Administrator views that profile, enabling cookie theft, session hijacking, or malicious activity on the site.

WordPress installations using the Redux Framework plugin version 4.5.13.1 or earlier are affected. The vulnerability is restricted to users who can edit their own profile and to site visitors with administrative view permissions over that profile.

The vulnerability carries a CVSS score of 6.4, indicating moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is authenticated exploitation: an attacker logs in, inserts a malicious slider value into their profile, saves it, and then waits for an administrator to view the profile page, at which point the stored script executes. Although it requires an authenticated user to prepare the payload, any user with Subscriber-level access can do so. Because the effect occurs only when an admin views the profile, the impact is largely confined to sites with multiple administrators and may lead to local privilege escalation or defacement.