CVE-2025-12045 is a stored cross-site scripting vulnerability in the Orbit Fox WordPress plugin (up to version 3.0.2). It occurs due to improper neutralization of input in the category and tag 'name' parameters, allowing authenticated users with Author-level privileges or above to inject arbitrary web scripts. These scripts execute when any user accesses the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 6.4 (medium severity). No official patch or vendor advisory is provided in the available data.

An attacker with Author-level access or higher can exploit this vulnerability to inject malicious scripts into pages via category and tag names. These scripts execute in the context of users visiting the affected pages, potentially compromising user sessions or performing unauthorized actions. The vulnerability does not affect availability but impacts confidentiality and integrity. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider removing or sanitizing category and tag names manually to prevent injection. Monitor for updates from themeisle regarding patches or official mitigations.