Stored Cross-Site Scripting Vulnerability in Orbit Fox Plugin for WordPress

CVE-2025-12045

What is CVE-2025-12045?

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress contains a Stored Cross-Site Scripting vulnerability due to inadequate sanitization of user inputs in the 'name' parameters for categories and tags. Authenticated attackers with Author-level access and above can exploit this flaw by injecting malicious web scripts. When users visit the affected pages, those scripts will execute, potentially compromising user data and site integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References