The Orbit Fox WordPress plugin version 3.0.0 has a stored cross-site scripting vulnerability due to improper sanitization of SVG files uploaded by authenticated users with upload permissions. The plugin's SVG upload feature allows these users to upload SVG files containing embedded JavaScript, which executes in the site context upon viewing the file. This vulnerability arises because the plugin does not sanitize the SVG content to remove or neutralize embedded scripts, enabling stored XSS attacks.

An authenticated user with upload capability can upload malicious SVG files containing JavaScript, which executes in the context of the affected site when the SVG is viewed. This can lead to stored cross-site scripting attacks, potentially allowing attackers to perform actions such as session hijacking, defacement, or other malicious activities within the user's browser session on the site. The impact is limited to users who have upload capabilities and the site context where the SVG is rendered.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the SVG upload feature if not required or restrict upload capabilities to trusted users only. Monitoring vendor channels for updates or patches is advised.