CVE-2026-5400 is a stored XSS vulnerability in the Redux Framework WordPress plugin affecting versions up to 4.5.13. The flaw is due to improper input neutralization of nested array values in the user_meta_save() function and unsafe rendering of CSS filter values without escaping in the render() function. This allows authenticated attackers with low privileges (subscriber and above) to inject malicious scripts that execute in the context of other users viewing the injected pages.

An attacker with subscriber-level access or higher can inject arbitrary web scripts into pages via the Media field filter values. These scripts execute whenever any user accesses the injected page, potentially leading to session hijacking, defacement, or other malicious actions within the context of the affected site. The vulnerability impacts confidentiality and integrity but does not affect availability.

No official patch or fix is currently referenced in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user privileges where possible and monitor for suspicious activity related to script injection. Avoid using affected versions of the Redux Framework plugin or apply any vendor-provided updates once released.