The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a… (CVE-2026-85418)
Source GCVE Database
Not known to be exploited · fixed in 3.0.9 : patch affected systems soon.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 3.0.9
What to do
AI-suggested
Upgrade the Orbit Fox plugin to version 3.0.9 or later, where this vulnerability is fixed. Since the vulnerability is resolved in 3.0.9, applying this official fix is the recommended remediation. No other mitigation guidance is provided in the available data.
Description
The Orbit Fox WordPress plugin before version 3.0.9 contains a vulnerability where it does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets. This flaw allows users with contributor-level access or higher to inject arbitrary web scripts that execute when any visitor views the affected page. This cross-site scripting (XSS) vulnerability could lead to unauthorized script execution in the context of the affected website.
Impact
Users with contributor-level access or higher can inject malicious scripts that execute in the browsers of any visitor to the affected page. This could lead to session hijacking, defacement, or other script-based attacks against visitors. The vulnerability affects the confidentiality and integrity of the website content and potentially the security of its users.
Summary
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin versions prior to 3.0.9 improperly validate user-supplied HTML tag names in a Beaver Builder widget. This lack of validation enables users with contributor-level permissions or above to inject arbitrary JavaScript code into the rendered page markup. When visitors load the affected page, the injected scripts execute in their browsers, constituting a stored cross-site scripting vulnerability.