CVE-2026-85418

Name of the Vulnerable Software and Affected Versions The Orbit Fox versions prior to 3.0.9

Description Insufficient input sanitization and output escaping in a Beaver Builder widget allow users with contributor-level access and above to inject arbitrary web scripts. This occurs because the plugin fails to validate a user-supplied HTML tag name before echoing it into the rendered markup, resulting in Stored Cross-Site Scripting (XSS), where scripts execute when any visitor views the affected page.

Recommendations Update to version 3.0.9 or later.