What is the CVSS score of CVE-2026-11358?

CVE-2026-11358 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Orbit Fox CVE-2026-11358

EUVD-2026-37850 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-18 Wordfence

GHSA-wxgf-m47q-jgj3

WordPress XSS Orbit Fox Wordpress Plugin Themeisle

4.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

4.0 MEDIUM

PR:H and AC:H reflect mandatory admin credentials and restricted-configuration prerequisite; UI:R added because XSS payload execution requires a victim to visit the injected page.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 06:23 vuln.today

CVE Published

Jun 18, 2026 - 05:34 cve.org

MEDIUM 4.4

DescriptionCVE.org

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Stored Cross-Site Scripting in the Orbit Fox WordPress plugin (ThemeIsle) allows authenticated administrators to inject persistent malicious scripts into pages served to any visiting user. Affected are all versions through 3.0.6, but only under specific deployment conditions: WordPress multisite networks or installations where the unfiltered_html capability has been explicitly disabled. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 4.4 reflects the elevated prerequisites and limited per-incident impact, though scope-changed XSS can still enable session theft and secondary phishing in affected deployments.

Technical ContextAI

Orbit Fox (cpe:2.3:a:themeisle:orbit_fox) is a multipurpose WordPress companion plugin by ThemeIsle providing features including menu icons, SVG support, cookie notices, and custom fonts. The vulnerability resides in the menu-icons module (obfx_modules/menu-icons/init.php, specifically at lines 118 and 296 as confirmed by the Wordfence Trac references for both 3.0.5 and 3.0.6). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning admin-supplied input saved to plugin settings is stored in the database and later rendered in page output without adequate sanitization or escaping. In a standard single-site WordPress install with unfiltered_html enabled, administrators can already inject raw HTML by design - the vulnerability specifically matters when WordPress is configured to restrict this (multisite networks enforce per-role HTML filtering; unfiltered_html can also be programmatically disabled), as the plugin bypasses those restrictions.

RemediationAI

A code changeset has been committed to the plugin repository (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3574306%40themeisle-companion&new=3574306%40themeisle-companion), indicating an upstream fix is available, though a specific released patched version number is not independently confirmed from the available data - administrators should update Orbit Fox to the latest available version from the WordPress plugin repository and verify the installed version exceeds 3.0.6. As an immediate compensating control for deployments that cannot patch promptly, restricting administrator account access to trusted users only reduces the attacker pool directly. On WordPress multisite networks, ensuring only trusted network super admins can manage plugin settings further limits exposure. Disabling or restricting the menu-icons module functionality within the plugin settings, if not in active use, eliminates the specific vulnerable code path identified in init.php. The Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/beb1268c-b680-4ebe-8fe2-65f656390038) should be monitored for confirmation of the exact patched release version.