The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin versions prior to 3.0.9 improperly validate user-supplied HTML tag names in a Beaver Builder widget. This lack of validation enables users with contributor-level permissions or above to inject arbitrary JavaScript code into the rendered page markup. When visitors load the affected page, the injected scripts execute in their browsers, constituting a stored cross-site scripting vulnerability.

Users with contributor-level access or higher can inject malicious scripts that execute in the browsers of any visitor to the affected page. This could lead to session hijacking, defacement, or other script-based attacks against visitors. The vulnerability affects the confidentiality and integrity of the website content and potentially the security of its users.

Upgrade the Orbit Fox plugin to version 3.0.9 or later, where this vulnerability is fixed. Since the vulnerability is resolved in 3.0.9, applying this official fix is the recommended remediation. No other mitigation guidance is provided in the available data.