The Orbit Fox by ThemeIsle plugin (versions 3.0.7 and earlier) contains a client‑side cross‑site scripting flaw that allows an attacker to embed malicious JavaScript into a WordPress site through the plugin’s input handling. The vulnerability is classified as CWE‑79 and can lead to defacement, cookie theft, session hijacking, or the delivery of malware to site visitors. No exploitation of server‑side code or administrative privileges is required for exploitation; the impact is limited to the script’s execution context within the victim’s browser.

WordPress sites that have installed the Orbit Fox by ThemeIsle plugin version 3.0.7 or earlier are affected. The plugin is distributed by Themeisle under the name Orbit Fox by ThemeIsle and is primarily used by site owners who rely on ThemeIsle’s companion functionality.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of 0.0014 indicates a very low exploitation probability. The flaw is not listed in CISA’s KEV catalog. Attackers would need access to the plugin’s public input points or a way to trick users into executing the injected script. Because the vulnerability is a classic XSS flaw, it is relatively straightforward to exploit in a web environment and could be used to deliver malicious payloads or manipulate the DOM for social engineering attacks.