CVE-2026-90992 describes a stored Cross-Site Scripting vulnerability in the Redux Framework WordPress plugin (versions up to and including 4.5.14). The flaw arises from improper neutralization of input in user meta fields such as 'user-mediaurl' media field, biography, session_tokens, and persisted_preferences. Authenticated attackers with Subscriber-level privileges can inject malicious scripts that become part of the site-wide redux_demo option when a media URL repair is triggered, leading to script execution in users' browsers.

An attacker with Subscriber-level access can inject arbitrary web scripts that execute in the context of the affected site, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

No official patch or fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restrict Subscriber-level user capabilities where possible and avoid triggering media URL repair functions that promote user meta fields to site-wide options. Implement additional input sanitization and output escaping as a temporary mitigation if feasible.