CVE-2026-11358

Name of the Vulnerable Software and Affected Versions Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More versions prior to 3.0.7

Description The plugin is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server, due to insufficient input sanitization and output escaping in admin settings. Authenticated attackers with administrator-level permissions or higher can inject arbitrary web scripts via the menu-item-icon parameter. These scripts execute whenever a user accesses an affected page. This issue specifically impacts multi-site installations and environments where unfiltered html has been disabled.

Recommendations Update the plugin to a version later than 3.0.6. As a temporary mitigation, restrict access to the admin settings associated with the menu-item-icon parameter.