CVE-2026-85418: Improper Neutralization of Input During Web Page Generation

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access an...

PT-2026-88877

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access an...

CVE-2026-16583: Improper Neutralization of Input During Web Page Generation

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

CVE-2026-11358: Improper Neutralization of Input During Web Page Generation

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-10874: Server-Side Request Forgery (SSRF)

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user m...

PT-2025-42646

Name of the Vulnerable Software and Affected Versions The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin versions prior to 3.0.2 Description The plugin does not properly restrict URLs used in the stock photo import feature, allowing a user ...

PT-2024-18847

Name of the Vulnerable Software and Affected Versions The Orbit Fox by ThemeIsle plugin for WordPress versions up to, and including, 2.10.32 Description The issue is related to Stored Cross-Site Scripting via the Registration Form widget due to insufficient input sanitization and output escaping...

PT-2024-15081

Name of the Vulnerable Software and Affected Versions The Orbit Fox by ThemeIsle plugin for WordPress versions up to, and including, 2.10.26 Description The issue is related to Stored Cross-Site Scripting via the plugin's custom fields due to insufficient input sanitization and output escaping on...

CVE-2023-2287

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing...