CVE-2026-90992

Published 1 October 2026 · tracked since 1 October 2026

Description

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-97661 HIGH 7.2
• CVE-2026-92244 HIGH 7.2
• CVE-2026-95687 HIGH 8.8
• CVE-2026-96268 MEDIUM 6.4
• CVE-2026-96573 HIGH 7.2
• CVE-2026-96813 HIGH 7.2
• CVE-2026-15983 HIGH 8.1
• CVE-2026-85235 HIGH 7.2
• CVE-2026-89424 MEDIUM 6.4
• CVE-2026-14995 HIGH 7.2

→ Open the live CVE board · all tools