What’s Vulnerable › Vulnerabilities

CVE-2021-24157: Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-05 · updated 2026-06-17
• Weakness: CWE-79

Description

Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfiltered_html capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could potentially be malicious.

Affected products

• themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: before 2.10.3 — fixed in 2.10.3

How to fix

Upgrade to a fixed version: themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More 2.10.3. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/28e42f4e-e38a-4bf4-b51b-d8f21c40f037
• https://www.wordfence.com/blog/2021/01/multiple-vulnerabilities-patched-in-orbit-fox-by-themeisle-plugin/
• https://wpscan.com/vulnerability/28e42f4e-e38a-4bf4-b51b-d8f21c40f037
• https://www.wordfence.com/blog/2021/01/multiple-vulnerabilities-patched-in-orbit-fox-by-themeisle-plugin/

Get alerted when CVE-2021-24157 or the next vulnerability affects your stack