CVE-2026-65563

MediumCVSS 5.9

Published: 27/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The Orbit Fox by ThemeIsle plugin version 3.0.7 and earlier contains a Cross-Site Scripting (XSS) vulnerability for users with the Author role. An Author can inject malicious scripts.

Risk Assessment

The risk involves script execution in other users' browsers, potentially leading to session theft or site defacement.

Recommendation

Update Orbit Fox by ThemeIsle to a version newer than 3.0.7 that includes input filtering fixes.

Other vulnerabilities in Orbit Fox by ThemeIsle

CVE-2025-58593Medium
The Orbit Fox by ThemeIsle plugin through version 3.0.0 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script is stored and executed in users' browsers.

Original NVD description (English source)

Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS