Unrated severityNVD Advisory· Published Sep 9, 2026

CVE-2026-85418

Description

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Orbit Fox Companioninferred
Range: <3.0.9
Package: https://wordpress.org/plugins/orbit-fox-companion
WordPress/Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & Morellm-fuzzy
Range: <3.0.9

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/8f9ba009-324f-46ef-853f-9f2e706c401e/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000