CVE-2026-16583

MediumCVSS 6.1

Published: 05/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before version 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled. This allows authenticated users with upload capability (Author and above by default, without the unfiltered_html capability) to upload SVG files containing JavaScript that executes in the site context when viewed, leading to Stored Cross-Site Scripting.

Risk Assessment

Risk of malicious script execution in the browsers of site visitors, potentially leading to session theft, account takeover, or other attacks.

Recommendation

Update the Orbit Fox plugin to version 3.0.8 or later, which fixes the vulnerability.

Other vulnerabilities in Orbit Fox WordPress plugin

CVE-2026-85418Medium
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.

Original NVD description (English source)

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability (Author and above by default, without the unfiltered_html capability) to upload SVG files containing JavaScript that executes in the site context when the file is viewed, leading to Stored Cross-Site Scripting.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS