The Orbit Fox plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation. Specifically, SVG file uploads are not properly sanitized or escaped, enabling authenticated users with Author-level privileges or above to embed arbitrary scripts. These scripts execute in the context of users who view the SVG files, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 2.10.36 and is tracked as CVE-2024-7778 with a CVSS 3.1 base score of 6.4.

An attacker with Author-level access or higher can exploit this vulnerability to inject malicious scripts via SVG uploads. These scripts execute in the browsers of users who access the SVG files, potentially leading to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level user privileges to trusted individuals only and consider disabling SVG uploads if possible to reduce risk.