CVE-2023-6781

Summary

CVE-2023-6781 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Orbit Fox plugin for WordPress by ThemeIsle. This issue, which exists in all versions up to and including 2.10.26, allows authenticated attackers with contributor-level permissions and above to inject malicious scripts into custom fields. These scripts will execute whenever a user accesses a page with the injected content, posing a serious security risk. The root cause is the insufficient input sanitization and output escaping of user-supplied values in the plugin.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.