The Orbit Fox WordPress plugin by ThemeIsle contains a stored cross-site scripting vulnerability (CWE-79) in its Registration Form widget due to improper neutralization of input during web page generation. Authenticated users with contributor-level privileges or higher can inject arbitrary scripts that execute in the context of other users viewing the affected pages. This vulnerability affects all versions up to 2.10.32. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official fix details are currently available.

Successful exploitation allows an authenticated contributor or higher to inject and execute arbitrary JavaScript in the context of other users visiting the affected pages. This can lead to information disclosure and integrity impacts such as session hijacking or unauthorized actions performed on behalf of other users. Availability is not affected. The vulnerability requires authentication with contributor-level privileges, limiting the attack surface to users with some level of access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable Registration Form widget if feasible. Monitor official ThemeIsle communications for updates regarding patches or mitigations.