WordPress Plugin Vulnerabilities

Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget

Description

The plugin does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.

Proof of Concept

Affects Plugins

Plugin icon
themeisle-companion
Fixed in 3.0.9

References

CVE
CVE-2026-85418

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Farid Narimanov
Submitter
Farid Narimanov
Submitter website
https://faridnarimanov.com
Submitter twitter
FaridNarimanov
Verified
Yes
WPVDB ID
8f9ba009-324f-46ef-853f-9f2e706c401e

Timeline

Publicly Published
2026-09-07 (about 2 days ago)
Added
2026-09-07 (about 1 day ago)
Last Updated
2026-09-07 (about 1 day ago)

Other

Published
Title
Published
2024-02-14
Title
Sydney Toolbox < 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-04-01
Title
Beds24 Online Booking < 2.0.28 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2020-01-22
Title
Ultimate Addons for Beaver Builder < 1.25.0 - Cross-Site Scripting (XSS)
Published
2026-02-17
Title
Membership Plugin – Restrict Content < 3.2.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings
Published
2025-08-05
Title
Exclusive Addons for Elementor < 2.7.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown