6.5Orta

CVE-2025-22659WordPress Orbit Fox by ThemeIsle plugin <= 2.10.44 - Cross Site Scripting (XSS) vulnerability

Themeisle Orbit Fox by ThemeIsle Yayım: 2025-03-27 18:01 (1 yıl önce)

Açıklama

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 2.10.44.

Zayıflık türü (CWE): CWE-79

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
themeisle	orbit fox	≤ 2.10.44
Themeisle	Orbit Fox by ThemeIsle	≤ 2.10.44

Kaynaklar ve yamalar

https://patchstack.com/database/Wordpress/Plugin/themeisle-companion/vulnerability/wordpress-orbit-fox-by-the… vdb-entryThird Party Advisory

CPE eşleşmeleri (NVD) (1)

cpe:2.3:a:themeisle:orbit_fox:*:*:*:*:*:wordpress:*:* ≤ 2.10.44

CVSS puanı

6.5Orta

Kaynak: Patchstack · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Düşük
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişir
Gizlilik: Düşük
Bütünlük: Düşük
Erişilebilirlik: Düşük

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Tüm puanlar (3)

cna	CVSS 3.1	6.5Orta
audit@patchstack.com	CVSS 3.1	6.5Orta
nvd	CVSS 3.1	5.4Orta

EPSS (30 günde istismar olasılığı)

0.29%

tüm CVE'lerin %22'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2025-01-07
Yayımlandı2025-03-27 18:01
IP-DB'ye ulaştı2026-10-25 00:01
Son güncelleme2026-06-17 11:49

Numarayı veren (CNA): Patchstack
NVD durumu: Modified

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

7.2Yüksek

CVE-2026-116753 12 saat önce

Multi Step for Contact Form 7 <= 2.9.1 - Unauthenticated Stored Cross-Site Scripting via Multipart Field Name

ninjateam Multi Step for Contact Form 7

The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multipart field name (array key)' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. Th…

7.2Yüksek

CVE-2026-120687 12 saat önce

Lightbox & Modal Popup WordPress Plugin <= 2.8.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Image Alt Attribute in .wp-caption Containers

fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient…

5.4Orta

CVE-2026-127115 12 saat önce

BuddyForms <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'title' Attribute of [bf_login_form] Shortcode

themekraft BuddyForms

The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buddyforms_form_content' parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for un…

6.4Orta

CVE-2026-110531 12 saat önce

FV Player 8 <= 8.1.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Popup' Shortcode Attribute via Profile Video

foliovision FV Player 8

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos' parameter in all versions up to, and including, 8.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authentic…

8.8Yüksek

CVE-2026-18053 15 saat önce

MemberDash <= 1.8.7 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Edit Profile 'id' Parameter

LearnDash MemberDash

The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the `user_account_manager()` function's edit_profile branch, where all submitted `$_POST` …

9.8Kritik

CVE-2026-19907 15 saat önce

Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator

shipo Shipo

The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's c…