Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, at line 56 of class-redux-spinner.php in the render() function, this value is rendered in an unquoted HTML attribute without escaping via '$data_string .= ' data-val=' . $this->value;'. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
🚨 Redux Framework に脆弱性（深刻度 中） 90万サイト以上が利用 / CVSS 6.4 修正版 4.5.14 が公開済み https://shindan.m-g-n.me/alerts/cve-2026-5410/
Post summary
The tweet announces a medium-severity CVE-2026-5410 in Redux Framework (CVSS 6.4), used by 900k+ sites, and notes that fixed version 4.5.14 is available. No PoC, exploit tool, or active exploitation is mentioned.
CVE-2026-5410 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insu… https://www.cve.org/CVERecord?id=CVE-2026-5410
Post summary
The text discloses CVE-2026-5410, a stored XSS vulnerability in the Redux Framework WordPress plugin affecting versions up to 4.5.13, without mentioning any PoC, exploit, patch, or active exploitation.