What is the CVSS score of CVE-2026-16583?

CVE-2026-16583 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-16583?

Yes, a public proof-of-concept exploit is available for CVE-2026-16583. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-16583?

Yes, a patch is available for CVE-2026-16583. Update the affected software to the latest version immediately.

Orbit Fox CVE-2026-16583

EUVD-2026-53102 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-05 WPScan

GHSA-j723-98hh-rm27

WordPress XSS Orbit Fox Unknown

6.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Author-level WordPress account required for upload confirms PR:L; victim must view the SVG file (UI:R); scope changes as payload executes in victim's browser origin.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:50 vuln.today

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 06:00 cve.org

MEDIUM 6.1

DescriptionCVE.org

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability (Author and above by default, without the unfiltered_html capability) to upload SVG files containing JavaScript that executes in the site context when the file is viewed, leading to Stored Cross-Site Scripting.

AnalysisAI

Stored XSS in the Orbit Fox WordPress plugin (versions before 3.0.8) allows authenticated users holding at least the Author role to upload malicious SVG files containing arbitrary JavaScript, which then executes in the browser context of any visitor who views the file - including administrators. The vulnerability is gated on the plugin's optional SVG upload feature being enabled. A public proof-of-concept is available via WPScan; CISA KEV listing is not confirmed, and EPSS sits at a low 0.17% (7th percentile), indicating limited automated campaign targeting at time of analysis. Vendor-released patch version 3.0.8 is available.

Technical ContextAI

SVG files are XML documents that can legally embed JavaScript via inline script tags and event handler attributes (e.g., onload, onclick). When a browser renders an SVG served from the same origin as a WordPress site, embedded scripts execute in that origin's DOM context - bypassing typical image sandboxing. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: the Orbit Fox plugin's SVG upload pathway fails to strip or sanitize script-bearing XML nodes before persisting the file. The result is a stored (persistent) XSS payload on the server. CPE data identifies the affected component as cpe:2.3:a:unknown:orbit_fox covering versions 3.0.0 through 3.0.7. The CVSS S:C (Scope Changed) metric correctly reflects that the XSS fires in a victim's browser session - a different security principal than the uploading attacker - allowing session token theft or forced admin-level actions.

RemediationAI

Upgrade the Orbit Fox plugin to version 3.0.8 or later, available from the WordPress plugin repository and confirmed by WPScan's disclosure at https://wpscan.com/vulnerability/29b2b8af-2fd9-40f1-8843-d0f16cfb706b/. If immediate patching is not possible, disable the SVG upload feature within the Orbit Fox plugin settings as a compensating control - this removes the vulnerable code path entirely with no impact on the plugin's other features (Duplicate Page, Menu Icons, Cookie Notice, Custom Fonts). Additionally, site administrators should audit existing media libraries for previously uploaded SVG files and remove or re-sanitize any that contain script content, since the patch does not retroactively clean already-uploaded files. Restricting the Author role's media upload capability via a role management plugin is an additional hardening step, though it may affect legitimate editorial workflows.