Advisories · Technology
davidanderson Redux Framework.
Every CVE that names davidanderson Redux Framework among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.4 Medium
Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript
- davidanderson Redux Framework
- Broken access control
- CVSS 6.4 Medium
Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension
- davidanderson Redux Framework
- Privilege escalation
- CVSS 6.4 Medium
Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
- davidanderson Redux Framework
- Broken access control
- CVSS 6.4 Medium
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 7.2 High
Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting
- davidanderson Redux Framework
- Unrestricted file upload