CVE-2021-24157— Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting
Quick assessment
Affected
Unknown Orbit Fox by ThemeIsle
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress Orbit Fox是WordPress开源的一个应用软件。一个以用户为中心的插件，具有易于使用的管理面板。 Orbit Fox by ThemeIsle 存在安全漏洞，该漏洞允许低级用户注入具有潜在恶意的脚本。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-24157
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting
Source: CVE Program / CVE List V5
Vulnerability Description
Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfiltered_html capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could potentially be malicious.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Orbit Fox 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Orbit Fox是WordPress开源的一个应用软件。一个以用户为中心的插件，具有易于使用的管理面板。 Orbit Fox by ThemeIsle 存在安全漏洞，该漏洞允许低级用户注入具有潜在恶意的脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Orbit Fox by ThemeIsle | 2.10.3 ~ 2.10.3 | - |
|
II. Public POCs for CVE-2021-24157
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-24157
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-24157 (2)
-
https://wpscan.com/vulnerability/28e42f4e-e38a-4bf4-b51b-d8f21c40f037 x_refsource_CONFIRM
Same Patch Batch · Unknown · 2021-04-05 · 45 CVEs total
| CVE-2021-24163 | Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disc | |
| CVE-2021-24166 | Ninja Forms < 3.4.34 - CSRF to OAuth Service Disconnection | |
| CVE-2021-24165 | Ninja Forms < 3.4.34 - Administrator Open Redirect | |
| CVE-2021-24167 | Web-Stat < 1.4.1 - API Key Disclosure | |
| CVE-2021-24153 | Yoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24154 | Theme Editor < 2.6 - Authenticated Arbitrary File Download | |
| CVE-2021-24155 | Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload | |
| CVE-2021-24156 | Testimonial Rotator <= 3.0.3 - Authenticated Stored Cross-Site Scripting | |
| CVE-2021-24158 | Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation | |
| CVE-2021-24152 | Popup Builder < 3.74 - Authenticated Reflected Cross-Site Scripting (XSS) | |
| CVE-2021-24164 | Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure | |
| CVE-2021-24159 | Contact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting | |
| CVE-2021-24176 | JH 404 Logger <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24175 | The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass | |
| CVE-2021-24174 | Database Backups <= 1.2.2.6 - CSRF to Backup Download | |
| CVE-2021-24173 | VM Backups <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24172 | VM Backups <= 1.0 - CSRF to Database Backup Download | |
| CVE-2021-24171 | WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload | |
| CVE-2021-24170 | User Profile Picture < 2.5.0 - Sensitive Information Disclosure | |
| CVE-2021-24169 | Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS) |
Showing top 20 of 45 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Orbit Fox by ThemeIsle
-
CVE-2026-65563
WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Sit -
CVE-2025-58593
WordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Sit -
CVE-2025-22659
WordPress Orbit Fox by ThemeIsle plugin <= 2.10.44 - Cross S -
CVE-2023-2287
Orbit Fox < 2.10.24 - Author+ Server-Side Request Forgery -
CVE-2021-24158
Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Es
Same vendor: Unknown
-
CVE-2026-97315
Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection i -
CVE-2026-88998
Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via -
CVE-2026-103308
Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment -
CVE-2026-82844
WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment By -
CVE-2026-101301
WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression v
Same weakness: CWE-79
-
CVE-2026-107867
WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scri -
CVE-2026-107422
WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Script -
CVE-2026-105874
WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (X -
CVE-2026-103904
Stored XSS Vulnerability in JTL-Shop -
CVE-2026-107428
WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cro
V. Comments for CVE-2021-24157
No comments yet