Orbit Fox CVE-2026-11358

Exploitation requires all three of the following conditions to be simultaneously true: (1) The attacker holds a WordPress user account with administrator-level permissions or above on the target site; (2) The targeted WordPress installation is either a multisite network or has had the unfiltered_html capability explicitly disabled - standard single-site installs with default settings are NOT affected; (3) The Orbit Fox plugin version is 3.0.6 or earlier and the menu-icons module is active. What limits exploitation: the high privilege requirement (PR:H) means external attackers must first fully compromise an admin account before this flaw is reachable; the configuration constraint (AC:H) means the majority of standard single-site WordPress deployments are entirely unaffected; and successful XSS execution still requires a victim user to visit the injected page (UI:R in practice).

The provided CVSS vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) and score of 4.4 accurately convey a constrained but real risk. PR:H confirms exploitation requires administrator-level credentials, which severely limits the attacker pool. AC:H reflects that the vulnerability is only relevant under specific non-default or administratively-restricted configurations (multisite or unfiltered_html disabled). The S:C (Scope Changed) metric is significant: a compromised admin account injecting XSS can escalate impact to ordinary site visitors - enabling session hijacking, credential phishing, or malware delivery to a broader user base, regardless of the admin's own limited privileges in a restricted environment. No EPSS data was provided in the source intelligence, and the vulnerability carries no CISA KEV designation and no known public exploit. The realistic threat actor is a malicious or compromised administrator on a specifically-configured WordPress deployment, not an external opportunistic attacker. This is a low-probability, moderate-consequence issue for affected configurations - organizations running multisite WordPress with this plugin should prioritize patching, while standard single-site installs with unfiltered_html intact are not affected.

A threat actor who has obtained administrator credentials on a WordPress multisite installation running Orbit Fox 3.0.6 or earlier navigates to the plugin's menu icons settings and injects a JavaScript payload into an insufficiently sanitized input field. The payload is stored in the database and executes in the browser of any user - including lower-privileged editors or subscribers - who subsequently visits a page where the injected menu icon is rendered, potentially harvesting session cookies or redirecting victims to attacker-controlled infrastructure. No public exploit code has been identified at time of analysis.