Unknown Fox vulnerabilities

• unknown orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget CVE-2026-85418 5.4 MediumSeptember 9, 2026
• unknown orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload CVE-2026-16583 6.1 MediumAugust 5, 2026
• themeisle orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter CVE-2026-11358 4.4 MediumJune 18, 2026
• themeisle orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more Orbit Fox Companion <= 3.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy CVE-2025-12045 6.4 MediumNovember 4, 2025
• unknown orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery CVE-2025-10874 Public exploit 5.5 MediumOctober 24, 2025
• themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 more Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter CVE-2024-13183 6.4 MediumJanuary 10, 2025
• themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 more Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget CVE-2025-0311 6.4 MediumJanuary 10, 2025
• themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 more Orbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CVE-2024-7778 6.4 MediumAugust 22, 2024
• themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 more Orbit Fox by ThemeIsle <= 2.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets CVE-2024-2484 6.4 MediumJune 22, 2024
• themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 more Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-1499 6.4 MediumMarch 13, 2024
• themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 more Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attribute CVE-2024-1497 6.4 MediumMarch 13, 2024
• themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 more Orbit Fox by ThemeIsle <= 2.10.32 - Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget CVE-2024-2126 6.4 MediumMarch 13, 2024
• themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 more Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-1323 6.4 MediumFebruary 27, 2024
• themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 more Orbit Fox by ThemeIsle <= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget CVE-2024-0508 6.4 MediumFebruary 5, 2024
• themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 more Orbit Fox by ThemeIsle <= 2.10.29 - Cross-Site Request Forgery CVE-2024-1162 4.3 MediumFebruary 2, 2024
• optimole – optimize images in real time, super page cache, rsocial revive social – social media auto post and scheduling automation plugin +10 more +12 more ThemeIsle SDK <= Various Versions - Missing Authorization CVE-2024-1047 5.3 MediumFebruary 2, 2024
• realmag777 fox, pluginus fox - currency switcher professional for woocommerce +1 more WooCommerce Currency Switcher < 1.3.7 - Authenticated (Low Privilege) Local File Inclusion CVE-2021-24566 8.8 HighJanuary 16, 2024
• themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 more Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields CVE-2023-6781 6.4 MediumJanuary 11, 2024
• themeisle orbit fox by themeisle, orbitfox +1 more Orbit Fox < 2.10.24 - Author+ Server-Side Request Forgery CVE-2023-2287 4.3 MediumMay 30, 2023
• foxy-shop foxyshop FoxyShop < 4.8.2 - Reflected Cross-Site Scripting CVE-2022-1220 6.1 MediumJuly 11, 2022
• themeisle orbit fox by themeisle, orbit fox +1 more Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation CVE-2021-24158 6.5 MediumApril 5, 2021
• themeisle orbit fox by themeisle, orbit fox +1 more Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting CVE-2021-24157 5.4 MediumApril 5, 2021