The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin versions before 3.0.8 allow authenticated users with upload permissions to upload SVG files without proper sanitization. This enables stored cross-site scripting (CWE-79) through JavaScript embedded in SVG files, which executes when the SVG is viewed in the site context. The vulnerability affects version 3.0.0 as explicitly stated. No official patch or remediation guidance is provided in the available data.

Successful exploitation allows an authenticated user with upload capability to execute arbitrary JavaScript in the context of the vulnerable WordPress site. This can lead to session hijacking, privilege escalation, or other attacks depending on the malicious payload. The CVSS score of 6.1 (medium severity) reflects the network attack vector with low complexity and limited privileges required but user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict SVG upload capabilities to trusted users only or disable the SVG upload feature if possible to prevent exploitation.