Stored Cross-Site Scripting Vulnerability in Orbit Fox Plugin by ThemeIsle

CVE-2024-2126

Summary

The Orbit Fox plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level access or higher to execute arbitrary web scripts via the Registration Form widget. This vulnerability is due to a lack of proper input sanitization and output escaping, enabling potential malicious code to be injected into web pages accessed by users. This poses a significant risk, as any user visiting the compromised page could unknowingly execute the injected scripts.

References