Meher Sudhakar Abbireddi

**Name of the Vulnerable Software and Affected Versions** Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More versions prior to 3.0.7 **Description** The plugin is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server, due to insufficient input sanitization and output escaping in admin settings. Authenticated attackers with administrator-level permissions or higher can inject arbitrary web scripts via the `menu-item-icon` parameter. These scripts execute whenever a user accesses an affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update the plugin to a version later than 3.0.6. As a temporary mitigation, restrict access to the admin settings associated with the `menu-item-icon` parameter.