The vulnerability is caused by improper neutralization of user input during WordPress page generation. Stored XSS can be introduced through the plugin, causing malicious scripts to be rendered and executed whenever a page that includes the compromised content is loaded by a visitor. The injected code runs within the context of the site and can perform attacks such as defacing, redirecting visitors, or providing a vector for additional exploitation.

WordPress installations that use the Themeisle Orbit Fox by ThemeIsle plugin version 2.10.44 or earlier are affected. The plugin is distributed as a WordPress plugin named Orbit Fox by ThemeIsle.

The CVSS score of 6.5 indicates moderate impact, while the EPSS score of less than 1 % shows a low likelihood of exploitation at this time. The flaw is not listed in CISA KEV. The stored XSS can likely be triggered by submitting content through any input field processed by the plugin; it requires the attacker to inject malicious code into that content and is then rendered to all users who view the page.