CVE-2026-11358 is a stored cross-site scripting vulnerability (CWE-79) in the Orbit Fox WordPress plugin (Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More). The flaw exists due to improper neutralization of input during web page generation, specifically in admin settings. Authenticated administrators can inject malicious scripts that execute in the context of users visiting the compromised pages. This vulnerability affects multi-site installations and installations with unfiltered_html disabled. No official patch or remediation level has been provided as of the published date.

An attacker with administrator-level access can inject arbitrary web scripts that execute in the browsers of users viewing the injected pages. This can lead to limited confidentiality and integrity impacts such as theft of session tokens or manipulation of page content. The vulnerability does not impact availability. The scope is changed due to the cross-site scripting affecting multiple users in multi-site environments. Exploitation requires high privileges and no user interaction is needed once the malicious script is injected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or limiting use of the plugin in multi-site environments or where unfiltered_html is disabled. Monitor official themeisle communications for updates or patches addressing this vulnerability.