WordPress plugin Orbit Fox by ThemeIsle security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Orbit Fox by ThemeIsle < 2.10.29 - Unauthenticated Connected API Keys Update

Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check on the registerreference function, allowing unauthenticated attackers to update the connected API keys...

PT-2024-17141 · Themeisle · Orbit Fox

Name of the Vulnerable Software and Affected Versions: The Orbit Fox by ThemeIsle plugin for WordPress versions up to, and including, 2.10.29 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the register reference function. This allow...

WordPress Orbit Fox by ThemeIsle Plugin <= 2.10.27 is vulnerable to Cross Site Scripting (XSS)

Software Orbit Fox by ThemeIsle Type Plugin Vulnerable versions = 2.10.27 Fixed in 2.10.28 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0508 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0f3afe461709 Credits Webbernaut...

CVE-2023-6781

The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions up to, and including, 2.10.26 due to insufficient input sanitization and output escaping on user supplied values. This makes it possible for authenticated...

CVE-2023-6781

The CVE-2023-6781 entry affects Orbit Fox by ThemeIsle (WordPress plugin) up to version 2.10.26, due to insufficient input sanitization and output escaping in custom fields, enabling stored XSS for authenticated users with contributor+ permissions. The issue is fixed in 2.10.27; upgrade to that v...

CVE-2023-6781 Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields

The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions up to, and including, 2.10.26 due to insufficient input sanitization and output escaping on user supplied values. This makes it possible for authenticated...

CVE-2023-6781 Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields

The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions up to, and including, 2.10.26 due to insufficient input sanitization and output escaping on user supplied values. This makes it possible for authenticated...

WordPress Plugin Orbit Fox by ThemeIsle Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Orbit Fox by ThemeIsle Plugin <= 2.10.26 is vulnerable to Cross Site Scripting (XSS)

Software Orbit Fox by ThemeIsle Type Plugin Vulnerable versions = 2.10.26 Fixed in 2.10.27 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6781 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fb89b560bda8 Credits Nex Team...

Orbit Fox Companion < 2.10.27 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields due to insufficient input sanitization and output escaping on user supplied values, allowing authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in...

Malicious code in orbit-themer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e59310eaedaf4f0aea5f0369808690dc45cb900d5acc5f22ba9503d8b1515421 The OpenSSF Package Analysis project identified 'orbit-themer' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

WordPress Orbit Fox by ThemeIsle Plugin < 2.10.24 SSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:themeisle:orbitfox"; ifdescription...

CVE-2023-2287

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing...

Server side request forgery (ssrf)

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing...

CVE-2023-2287 Orbit Fox < 2.10.24 - Author+ Server-Side Request Forgery

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing...

CVE-2023-2287 Orbit Fox < 2.10.24 - Author+ Server-Side Request Forgery

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing...

CVE-2023-2287

The vulnerability CVE-2023-2287 affects the Orbit Fox by ThemeIsle WordPress plugin prior to version 2.10.24. Root cause: the stock photo import feature does not restrict target URLs, enabling potential server-side requests (SSRF) to arbitrary URLs. Impact described in sources as SSRF; no exploit...

PT-2023-18742 · Themeisle · Orbit Fox

Name of the Vulnerable Software and Affected Versions: Orbit Fox by ThemeIsle WordPress plugin versions prior to 2.10.24 Description: The issue allows users to specify arbitrary URLs for the stock photo import feature, leading to a server-side request forgery. This enables users to force the serv...

WordPress plugin Orbit Fox by ThemeIsle 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability previously exist...