CVE-2025-10874

MediumCVSS 5.5

Published: 24/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Orbit Fox plugin for WordPress before version 3.0.2 does not limit URLs that can be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to server-side request forgery as the user may force the server to access any URL of their choosing.

Risk Assessment

An attacker can use the server to scan the internal network, access otherwise inaccessible resources, or launch attacks against other systems, potentially leading to data leakage or system integrity compromise.

Recommendation

It is recommended to immediately update the Orbit Fox plugin to version 3.0.2 or later, which includes a fix that restricts URLs in the photo import feature.

Other vulnerabilities in Orbit Fox

CVE-2025-12045Medium
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the category and tag 'name' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Author-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

Original NVD description (English source)

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS