Stored Cross-Site Scripting in Orbit Fox by ThemeIsle for WordPress

CVE-2024-13183

Summary

The Orbit Fox plugin by ThemeIsle for WordPress is susceptible to a stored cross-site scripting (XSS) vulnerability. This flaw arises from inadequate input sanitization and output escaping in the 'title_tag' parameter, permitting authenticated users with Contributor-level access or higher to inject arbitrary web scripts. These malicious scripts could execute on pages accessed by users, creating potential for data exfiltration, session hijacking, or other harmful actions. It is critical for website administrators to update the plugin to the latest version to mitigate this risk and ensure secure interactions.

References