CVE-2025-12045

MediumCVSS 6.4

Published: 04/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the category and tag 'name' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Author-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

Risk Assessment

An attacker with Author-level access can perform an XSS attack, potentially leading to session theft, administrator account takeover, or website content modification.

Recommendation

Update the Orbit Fox plugin to a version later than 3.0.2. Consider restricting the ability to create categories and tags for low-privileged users.

Other vulnerabilities in Orbit Fox

CVE-2025-10874Medium
The Orbit Fox plugin for WordPress before version 3.0.2 does not limit URLs that can be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to server-side request forgery as the user may force the server to access any URL of their choosing.

Original NVD description (English source)

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the category and tag 'name' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS