The Orbit Fox plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the Pricing Table widget's $settings['title_tags'] parameter due to inadequate input sanitization and output escaping. This allows authenticated users with contributor-level access or higher to inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. The vulnerability affects all versions up to and including 2.10.30. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. The impact includes potential information disclosure and integrity compromise of web content. No patch or remediation details are currently provided by the vendor, and no exploits are known in the wild.

An authenticated attacker with contributor or higher privileges can inject malicious scripts into pages via the Pricing Table widget, leading to stored cross-site scripting. This can result in the execution of arbitrary scripts in the context of users visiting the injected pages, potentially compromising confidentiality and integrity of user interactions with the affected site. There is no indication of availability impact. The vulnerability requires authenticated access but no user interaction to trigger the script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Pricing Table widget if feasible. Monitor official ThemeIsle communications for updates regarding patches or mitigations.