Orbit Fox by ThemeIsle < 3.0.8 – Author+ Stored XSS via SVG Upload | CVE 2026-16583

Description

The plugin does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability (Author and above by default, without the unfiltered_html capability) to upload SVG files containing JavaScript that executes in the site context when the file is viewed, leading to Stored Cross-Site Scripting.

Proof of Concept

The PoC will be displayed on August 10, 2026, to give users the time to update.

Affects Plugins

themeisle-companion

Fixed in 3.0.8

References

CVE

CVE-2026-16583

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

6.8 (medium)

Miscellaneous

Original Researcher

Shivamani Vastrala

Submitter

Shivamani Vastrala

Verified

Yes

WPVDB ID

29b2b8af-2fd9-40f1-8843-d0f16cfb706b

Timeline

Publicly Published

2026-07-27 (about 9 days ago)

Added

2026-07-27 (about 8 days ago)

Last Updated

2026-07-27 (about 8 days ago)

Other

Published

Title

Published

2024-01-22

Title

Accelerated Mobile Pages < 1.0.93 - Unautenticated Reflected Cross-Site Scripting

Published

2024-05-29

Title

Remote Content Shortcode <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-12-12

Title

Goodlayers Core < 2.0.10 - Contributor+ Stored XSS

Published

2015-04-20

Title

Google Analytics Top Content Widget < 1.5.7 - Reflected XSS

Published

2025-11-20

Title

Tainacan < 1.0.1 - Reflected Cross-Site Scripting