Plugin icon

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More

themeisle-companion

Vulnerabilities:

20

Last Updated:

December 10, 2025

Active Installs:

100000

Published
Title
Fixed in
CVSS
Published
2025-11-03
Title
Orbit Fox Companion < 3.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy
Fixed in
Fixed in 3.0.3
CVSS
6.4 (medium)
Published
2025-10-03
Title
Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery
Fixed in
Fixed in 3.0.2
CVSS
5.5 (medium)
Published
2025-09-03
Title
Orbit Fox by ThemeIsle < 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.0.1
CVSS
6.4 (medium)
Published
2025-02-03
Title
Orbit Fox by ThemeIsle < 2.10.45 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.10.45
CVSS
6.4 (medium)
Published
2025-01-09
Title
Orbit Fox by ThemeIsle < 2.10.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter
Fixed in
Fixed in 2.10.44
CVSS
6.4 (medium)
Published
2025-01-09
Title
Orbit Fox by ThemeIsle < 2.10.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget
Fixed in
Fixed in 2.10.44
CVSS
6.4 (medium)
Published
2024-08-21
Title
Orbit Fox by ThemeIsle < 2.10.37 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Fixed in
Fixed in 2.10.37
CVSS
6.4 (medium)
Published
2024-06-21
Title
Orbit Fox by ThemeIsle < 2.10.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets
Fixed in
Fixed in 2.10.35
CVSS
6.4 (medium)
Published
2024-03-07
Title
Orbit Fox by ThemeIsle < 2.10.33 - Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget
Fixed in
Fixed in 2.10.33
CVSS
6.4 (medium)
Published
2024-02-26
Title
Orbit Fox by ThemeIsle < 2.10.32 - Contributor+ Stored XSS via Post Type Grid Widget
Fixed in
Fixed in 2.10.32
CVSS
5.9 (medium)
Published
2024-02-26
Title
Orbit Fox by ThemeIsle < 2.10.31 - Contributor+ Stored XSS via Pricing Table Widget
Fixed in
Fixed in 2.10.31
CVSS
5.9 (medium)
Published
2024-02-26
Title
Orbit Fox by ThemeIsle < 2.10.31 - Contributor+ Stored XSS via Form Widget
Fixed in
Fixed in 2.10.31
CVSS
5.9 (medium)
Published
2024-02-01
Title
Orbit Fox by ThemeIsle < 2.10.30 - Connected API Keys Update via CSRF
Fixed in
Fixed in 2.10.30
CVSS
4.3 (medium)
Published
2024-02-01
Title
Orbit Fox by ThemeIsle < 2.10.29 - Unauthenticated Connected API Keys Update
Fixed in
Fixed in 2.10.29
CVSS
5.3 (medium)
Published
2024-01-15
Title
Orbit Fox by ThemeIsle < 2.10.28 - Contributor+ Stored XSS
Fixed in
Fixed in 2.10.28
CVSS
6.4 (medium)
Published
2024-01-05
Title
Orbit Fox Companion < 2.10.27 - Contributor+ Stored XSS
Fixed in
Fixed in 2.10.27
CVSS
6.4 (medium)
Published
2023-05-02
Title
Orbit Fox < 2.10.24 - Author+ Server-Side Request Forgery
Fixed in
Fixed in 2.10.24
CVSS
5.5 (medium)
Published
2021-01-12
Title
Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting
Fixed in
Fixed in 2.10.3
CVSS
6.4 (medium)
Published
2021-01-12
Title
Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation
Fixed in
Fixed in 2.10.3
CVSS
9.9 (critical)
Published
2018-12-07
Title
Orbit Fox by ThemeIsle <= 2.6.3 -Does not properly Authenticate REST API Calls
Fixed in
Fixed in 2.6.4
CVSS
n/a