CVE-2026-85418— Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget
Quick assessment
Affected
Unknown Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Orbit Fox: Duplicate Page、菜单图标、SVG 支持、Cookie 通知、自定义字体等 WordPress 插件，在 3.0.9 版本之前，未对其 Beaver Builder 小部件中用户输入的 HTML 标签名进行充分验证，就直接将其回显到渲染后的标记中。这使得拥有“贡献者（contributor）”及以上权限的用户能够注入任意的 Web 脚本，这些脚本会在任意访客浏览受影响页面时执行。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | < 3.0.9 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85418
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget
Source: CVE Program / CVE List V5
Vulnerability Description
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | 0 ~ 3.0.9 | - |
|
II. Public POCs for CVE-2026-85418
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85418
请登录查看更多情报信息。
Other References for CVE-2026-85418 (1)
-
🔗 Orbit Fox < 3.0.9 – Contributor+ Stored XSS via Beaver Builder Pricing Table Widget | CVE 2026-85418 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-09 · 28 CVEs total
| CVE-2026-19855 | 6.5 MEDIUM | Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Short |
| CVE-2026-85117 | 6.5 MEDIUM | Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via F |
| CVE-2026-83537 | 5.3 MEDIUM | WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_paymen |
| CVE-2026-80440 | 4.8 MEDIUM | Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Plac |
| CVE-2025-15690 | Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles | |
| CVE-2026-13144 | WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset | |
| CVE-2026-13146 | WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR | |
| CVE-2026-14962 | ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id | |
| CVE-2026-18042 | WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation | |
| CVE-2026-16960 | Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure | |
| CVE-2026-75861 | Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction | |
| CVE-2026-80339 | Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure | |
| CVE-2026-80340 | Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure | |
| CVE-2026-80341 | Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assign | |
| CVE-2026-81021 | SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure | |
| CVE-2026-81741 | Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter | |
| CVE-2026-81022 | SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak | |
| CVE-2026-82185 | WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Rese | |
| CVE-2026-82848 | Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure | |
| CVE-2026-82184 | WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
-
CVE-2026-16583
Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG -
CVE-2026-11358
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie N -
CVE-2025-12045
Orbit Fox Companion <= 3.0.2 - Authenticated (Author+) Store -
CVE-2025-10874
Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery -
CVE-2024-13183
Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contribut
Same vendor: Unknown
-
CVE-2026-92924
Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbi -
CVE-2026-97219
MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via -
CVE-2026-91020
WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticat -
CVE-2026-90987
Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenti -
CVE-2026-90952
WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated S
V. Comments for CVE-2026-85418
No comments yet