This vulnerability in ThemeIsle's Orbit Fox plugin allows stored cross-site scripting due to improper input sanitization during web page generation. An attacker with low privileges can inject malicious scripts that may be executed in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, privileges required, user interaction required, and scope change. The vulnerability affects all versions up to 3.0.0.

Successful exploitation can lead to execution of arbitrary scripts in the context of other users, potentially resulting in limited information disclosure, modification of content, or disruption of availability. The CVSS score of 6.5 reflects these impacts as medium severity. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting plugin usage to trusted users only and monitor for suspicious activity. Avoid exposing the vulnerable plugin to untrusted users. Follow ThemeIsle's official channels for updates on patches or mitigations.