EUVD-2026-74720
GHSA-q29h-rjf7-v37r
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Contributor account is the minimum privilege (PR:L), victim page view is required (UI:R), and scope change (S:C) reflects persistent payload impact across all site visitors.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.
AnalysisAI
Stored cross-site scripting in the Orbit Fox WordPress plugin (before version 3.0.9) allows users holding at minimum contributor-level access to inject arbitrary JavaScript by supplying an unsanitized HTML tag name within a Beaver Builder widget, with the malicious script persisting in page markup and executing in the browser of every subsequent visitor. The vulnerability carries a CVSS 5.4 Medium score and a publicly available proof-of-concept has been confirmed by WPScan, lowering the bar for exploitation on multi-author sites. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the WordPress site to have the Orbit Fox plugin installed at a version before 3.0.9 with the Beaver Builder page builder integration active and in use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 score appropriately reflects the authentication barrier (PR:L - contributor access required) and victim interaction dependency (UI:R), which together meaningfully constrain opportunistic mass exploitation; the EPSS at 0.15% and 5th percentile corroborates this low automated-exploitation signal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Orbit Fox plugin to version 3.0.9 or later; this release validates the user-supplied HTML tag name before rendering and represents the vendor-confirmed fix per the WPScan advisory (https://wpscan.com/vulnerability/8f9ba009-324f-46ef-853f-9f2e706c401e/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders f
Stored XSS in the Orbit Fox WordPress plugin (versions before 3.0.8) allows authenticated users holding at least the Aut
Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. Rated medium seve
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fo
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Table widge
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Registration Form w
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form widget addr2_w
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Services and Post T
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Type
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fie
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Ta
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today