CVE-2026-5399 is a stored cross-site scripting vulnerability in the Redux Framework WordPress plugin affecting versions up to and including 4.5.13.1. The issue stems from the user_meta_save() function, which inadequately sanitizes scalar input values, and the Redux_Slider::render() method, which outputs slider values into unquoted HTML attributes without proper escaping. Additionally, the clean_default() method's loose type casting allows malicious strings to bypass validation. This enables authenticated attackers with Subscriber-level or higher privileges to inject arbitrary JavaScript into their user profiles, which executes when an Administrator views the profile.

An attacker with Subscriber-level access or higher can inject malicious scripts into their user profile via the Slider field. These scripts execute in the context of an Administrator's browser when they view the attacker's profile, potentially leading to session hijacking, privilege escalation, or other malicious actions within the WordPress admin interface. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity impact with network attack vector, low attack complexity, and no user interaction required.

No official fix or patch is currently confirmed for this vulnerability. Administrators should monitor the vendor's advisory for updates. Until a patch is available, restrict Subscriber-level user privileges where possible and avoid viewing untrusted user profiles. Implementing additional input validation or output escaping at the application or web server level may help mitigate risk.