Orbit Fox by ThemeIsle contains stored cross‑site scripting because user supplied attributes in the Pricing Table widget are not properly sanitized or escaped. The vulnerability can be exploited by any authenticated user with contributor‑level permissions or higher to inject JavaScript that will run whenever a visitor loads the page. The result is an arbitrary script execution on the victim’s browser, providing an attacker with the same privileges as the authenticated user such as credential stealing, cookie theft, or launching further attacks. The weakness is an instance of input validation failure and inadequate output encoding (CWE‑79).

The vulnerability affects the Orbit Fox plugin for WordPress on all versions up to and including 2.10.43, including the Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts, and other modules distributed by ThemeIsle. Users installing or upgrading the plugin through the WordPress plugin repository or via a third‑party update mechanism are potentially impacted if they have not applied the vendor’s security fix.

The CVSS score of 6.4 categorizes this flaw as a moderate severity issue, and the EPSS score of less than 1% indicates that, according to current data, exploitation chances are low but non‑zero. It is not yet listed in CISA’s KEV catalog. The likely attack vector involves an authenticated contributor editing a pricing table, where the malicious JavaScript is stored in the database and later rendered on any page that references the widget. Once the flaw is exploited, the impact is limited to user browsers encountering the affected page, but it can lead to wide‑scale credential theft or session hijacking within the site’s audience.