Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API.

Etkilenen sürümler1 yazılım

Kaynaklar9 kaynak

• CVE.org kaydı
• NVD kaydı
• wordfence.com/…lities/id/a4d54e48-3a7f-4add-b842-6948377f2a73 Diğer
• plugins.trac.wordpress.org/…_media/multi_media/class-redux-multi-media.php Diğer
• plugins.trac.wordpress.org/…_media/multi_media/class-redux-multi-media.php Diğer
• plugins.trac.wordpress.org/…tensions/users/class-redux-extension-users.php Diğer
• plugins.trac.wordpress.org/…tensions/users/class-redux-extension-users.php Diğer
• plugins.trac.wordpress.org/changeset Diğer
• plugins.trac.wordpress.org/…_media/multi_media/class-redux-multi-media.php Diğer

Kayıt geçmişi

1. 30 Eki 2026 20:15Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-103997Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via…
• 6,1 CVE-2026-104926WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter
• 6,4 CVE-2026-107711FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint
• 7,2 CVE-2026-120114Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint
• 6,1 CVE-2026-100151Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter
• 6,4 CVE-2026-96554BuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name