CVE-2025-58593

MediumCVSS 6.5

Published: 03/09/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The Orbit Fox by ThemeIsle plugin through version 3.0.0 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script is stored and executed in users' browsers.

Risk Assessment

An attacker can store malicious code that executes in visitors' browsers, enabling session theft or content modification. This affects confidentiality and integrity of the WordPress site.

Recommendation

Update the Orbit Fox plugin to a version later than 3.0.0. Deploy input validation and a WAF.

Other vulnerabilities in Orbit Fox by ThemeIsle

CVE-2026-65563Medium
The Orbit Fox by ThemeIsle plugin version 3.0.7 and earlier contains a Cross-Site Scripting (XSS) vulnerability for users with the Author role. An Author can inject malicious scripts.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 3.0.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS