Executive Summary

The vulnerability exists in the Orbit Fox plugin for WordPress, specifically in versions up to and including 3.0.6. It is a Stored Cross-Site Scripting (XSS) flaw that occurs due to insufficient input sanitization and output escaping in the admin settings.

This vulnerability allows authenticated users with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the injected page.

It only affects multi-site WordPress installations or installations where the unfiltered_html capability has been disabled.

Useful 0 Not Useful 0

Impact Analysis

An attacker with administrator-level access can exploit this vulnerability to inject malicious scripts into pages. These scripts can execute in the context of users visiting those pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions.

Because the vulnerability is a Stored XSS, the malicious code persists on the affected site and can impact multiple users.

However, exploitation requires high privileges (administrator or above) and only affects certain WordPress configurations (multi-site or with unfiltered_html disabled).

Useful 0 Not Useful 0