themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More vulnerabilities

19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More version is affected

Latest themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More vulnerabilities

CVE-2026-65563 — WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
CVE-2026-11358 — Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter (CVSS 4.4)
CVE-2025-12045 — Orbit Fox Companion <= 3.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy (CVSS 6.4)
CVE-2025-58593 — WordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
CVE-2025-22659 — WordPress Orbit Fox by ThemeIsle plugin <= 2.10.44 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
CVE-2024-13183 — Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter (CVSS 5.4)
CVE-2025-0311 — Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget (CVSS 5.4)
CVE-2024-7778 — Orbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 5.4)
CVE-2024-2484 — Orbit Fox by ThemeIsle <= 2.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets (CVSS 5.4)
CVE-2024-2126 — Orbit Fox by ThemeIsle <= 2.10.32 - Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget (CVSS 5.4)
CVE-2024-1499 — Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
CVE-2024-1497 — Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attribute (CVSS 5.4)
CVE-2024-1323 — Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
CVE-2024-0508 — Orbit Fox by ThemeIsle <= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget (CVSS 5.4)
CVE-2024-1162 — Orbit Fox by ThemeIsle <= 2.10.29 - Cross-Site Request Forgery (CVSS 4.3)
CVE-2024-1047 — ThemeIsle SDK <= Various Versions - Missing Authorization (CVSS 5.3)
CVE-2023-6781 — Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields (CVSS 5.4)
CVE-2021-24158 — Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation (CVSS 6.5)
CVE-2021-24157 — Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting (CVSS 5.4)