Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More vulnerabilities

Product

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More

by themeisle · last CVE Jun 18, 2026

CVEs

On KEV

6.4

Max CVSS

New 30D

Vulnerabilities14 In the news0 Timeline

Severity mix

Critical 0High 0Medium 14Low 0

Severity

All severities14 Critical0 High0 Medium14 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-12045	6.4	0%	Nov 4	Orbit Fox Companion <= 3.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy Affected: through 3.0.2
CVE-2024-13183	5.4	0%	Jan 10	Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter Affected: through 2.10.43
CVE-2025-0311	5.4	0%	Jan 10	Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget Affected: through 2.10.43
CVE-2024-7778	5.4	0%	Aug 22	Orbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Affected: through 2.10.36
CVE-2024-2484	5.4	0%	Jun 22	Orbit Fox by ThemeIsle <= 2.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets Affected: through 2.10.34
CVE-2024-1499	5.4	1%	Mar 13	Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 2.10.30
CVE-2024-1497	5.4	1%	Mar 13	Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attribute Affected: through 2.10.30
CVE-2024-2126	5.4	0%	Mar 13	Orbit Fox by ThemeIsle <= 2.10.32 - Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget Affected: through 2.10.32
CVE-2024-1323	5.4	0%	Feb 27	Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 2.10.31
CVE-2024-0508	5.4	1%	Feb 5	Orbit Fox by ThemeIsle <= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget Affected: through 2.10.27
CVE-2023-6781	5.4	0%	Jan 11	Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields Affected: through 2.10.26
CVE-2024-1047	5.3	1%	Feb 2	ThemeIsle SDK <= Various Versions - Missing Authorization Affected: through 2.10.28
CVE-2026-11358	4.4	0%	Jun 18	Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter Affected: through 3.0.6
CVE-2024-1162	4.3	0%	Feb 2	Orbit Fox by ThemeIsle <= 2.10.29 - Cross-Site Request Forgery Affected: through 2.10.29