VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More security & vulnerabilities

themeisle-companion— active installsLast vulnerability Sep 7, 2026

No known unpatched vulnerabilities in the latest version

All 24 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
24Known vulnerabilities
  • Critical1
  • High2
  • Medium21
  • Low0
Vulnerabilities per year
2018: 1 vulnerability1182020: 1 vulnerability1202021: 1 vulnerability1212023: 1 vulnerability1232024: 10 vulnerabilities10242025: 6 vulnerabilities6252026: 4 vulnerabilities426

All Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More vulnerabilities

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.0.8Update to 3.0.9
CVE-2026-85418
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤3.0.7Update to 3.0.8
CVE-2026-16583
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤3.0.7Update to 3.0.8
CVE-2026-65563
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter
≤3.0.6Update to 3.0.7
CVE-2026-11358
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy
≤3.0.2Update to 3.0.3
CVE-2025-12045
Medium6.4Authenticated (Author+) Server-Side Request Forgery
≤3.0.1Update to 3.0.2
CVE-2025-10874
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.0.0Update to 3.0.1
CVE-2025-58593
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.10.44Update to 2.10.45
CVE-2025-22659
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter
≤2.10.43Update to 2.10.44
CVE-2024-13183
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget
≤2.10.43Update to 2.10.44
CVE-2025-0311
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
≤2.10.36Update to 2.10.37
CVE-2024-7778
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets
≤2.10.34Update to 2.10.35
CVE-2024-2484
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget
≤2.10.32Update to 2.10.33
CVE-2024-2126
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.10.31Update to 2.10.32
CVE-2024-1323
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.10.30Update to 2.10.31
CVE-2024-1499
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attribute
≤2.10.30Update to 2.10.31
CVE-2024-1497
Medium4.3Cross-Site Request Forgery
≤2.10.29Update to 2.10.230
CVE-2024-1162
Medium5.3Missing Authorization
≤2.6.9Update to 2.6.10
CVE-2024-1047
Medium6.4Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget
≤2.10.27Update to 2.10.28
CVE-2024-0508
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields
≤2.10.26Update to 2.10.27
CVE-2023-6781
High7.4Authenticated (Author+) Server-Side Request Forgery via URL
<2.10.24Update to 2.10.24
CVE-2023-2287
Medium6.4Authenticated (Contributor+) Stored Cross Site Scripting
<2.10.3Update to 2.10.3
CVE-2021-24157
Critical9.9Authenticated Privilege Escalation
<2.10.3Update to 2.10.3
CVE-2021-24158
High7.3Improper REST Capabilities Checks
≤2.6.3Update to 2.6.4
—

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: common questions

Does Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More have known vulnerabilities?

Yes. VulnCrest Radar lists 24 known vulnerabilities in Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: 1 critical, 2 high, 21 medium. None are known to affect version null.

How do I check which version of Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More vulnerability?

CVE-2026-85418, published Sep 7, 2026: Orbit Fox <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).

Is any Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More vulnerability listed in CISA KEV?

No. None of the known Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?