The Orbit Fox Companion WordPress plugin is affected by a stored cross‑site scripting flaw that is triggered by entering malicious content into the category or tag 'name' fields. Because the plugin fails to properly sanitize or escape these inputs, an authenticated user with author-level or higher permissions can store arbitrary scripts on taxonomy terms. These scripts execute automatically when any visitor views a page that uses the compromised taxonomy, allowing the attacker to run code in the context of the site.

The affected product is the Orbit Fox Companion plugin, developed by themeisle, for WordPress. All releases through version 3.0.2 are impacted, including the variant that includes Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More.

The CVSS score of 6.4 indicates moderate severity. The EPSS value of less than 1% shows a low probability of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have WordPress author or higher privileges and the ability to edit taxonomy term names. Once injected, the script persists and affects all users who view pages using the contaminated taxonomy.