CVE-2026-85418: CWE-79 Cross-Site Scripting (XSS) in Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
CVE-2026-85418 is a cross-site scripting (XSS) vulnerability in the WordPress plugin Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More. Versions before 3.0.9 do not properly validate user-supplied HTML tag names in a Beaver Builder widget, allowing users with contributor-level access or higher to inject arbitrary scripts. These scripts execute when any visitor views the affected page, potentially leading to client-side attacks. No official patch or remediation guidance is currently available from the vendor. No known exploits in the wild have been reported.
AI Analysis
Technical Summary
The vulnerability arises from insufficient validation of user-supplied HTML tag names in one of the Beaver Builder widgets included in the Orbit Fox WordPress plugin. This flaw allows users with contributor-level permissions or above to inject arbitrary JavaScript code into pages, which executes in the context of visitors viewing those pages. This is classified as CWE-79 (Cross-Site Scripting). The plugin versions prior to 3.0.9 are affected. No CVSS score or vendor advisory is currently available, and no patch status is confirmed.
Potential Impact
Successful exploitation enables users with contributor-level access or higher to inject and execute arbitrary scripts in the browsers of site visitors. This can lead to theft of cookies, session tokens, or other sensitive information accessible via the browser, as well as potential defacement or redirection attacks. The impact is limited to sites using the affected plugin versions and depends on the attacker's ability to create or edit content via the vulnerable widget.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access and above to trusted users only. Monitor official Orbit Fox plugin channels for updates and apply any released patches promptly.
CVE-2026-85418: CWE-79 Cross-Site Scripting (XSS) in Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
Description
CVE-2026-85418 is a cross-site scripting (XSS) vulnerability in the WordPress plugin Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More. Versions before 3.0.9 do not properly validate user-supplied HTML tag names in a Beaver Builder widget, allowing users with contributor-level access or higher to inject arbitrary scripts. These scripts execute when any visitor views the affected page, potentially leading to client-side attacks. No official patch or remediation guidance is currently available from the vendor. No known exploits in the wild have been reported.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from insufficient validation of user-supplied HTML tag names in one of the Beaver Builder widgets included in the Orbit Fox WordPress plugin. This flaw allows users with contributor-level permissions or above to inject arbitrary JavaScript code into pages, which executes in the context of visitors viewing those pages. This is classified as CWE-79 (Cross-Site Scripting). The plugin versions prior to 3.0.9 are affected. No CVSS score or vendor advisory is currently available, and no patch status is confirmed.
Potential Impact
Successful exploitation enables users with contributor-level access or higher to inject and execute arbitrary scripts in the browsers of site visitors. This can lead to theft of cookies, session tokens, or other sensitive information accessible via the browser, as well as potential defacement or redirection attacks. The impact is limited to sites using the affected plugin versions and depends on the attacker's ability to create or edit content via the vulnerable widget.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access and above to trusted users only. Monitor official Orbit Fox plugin channels for updates and apply any released patches promptly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-03T19:33:55.847Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa0f7c6acd9273b49d85804
Added to database: 09/09/2026, 06:08:06 UTC
Last enriched: 09/09/2026, 06:22:46 UTC
Last updated: 09/09/2026, 07:11:25 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.