# CVE-2026-11358: ThemeIsle Orbit Fox Stored XSS in admin settings

Source: https://junglewise.ai/threats/cve-2026-11358-themeisle-orbit-fox-stored-xss-in-admin-settings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-11358 · Severity: medium · CVSS 4.4 · Published 2026-06-18

Orbit Fox is a WordPress plugin that adds various features like menu icons, cookie notices, and custom fonts to websites. A security vulnerability in this plugin allows users with administrative access to inject malicious scripts into the site's settings. This could lead to unauthorized actions or data theft when other users visit the affected pages, particularly in multi-site environments where certain security restrictions are in place.

Technologies: [Themeisle Orbit Fox](https://junglewise.ai/threats/technologies/orbit-fox). Vendors: [Themeisle](https://junglewise.ai/threats/vendors/themeisle).

## Quick answers

**Is CVE-2026-11358 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11358 being exploited in the wild.

**How severe is CVE-2026-11358?** Medium severity, with a CVSS score of 4.4, published 18 June 2026.

**Which products and versions are affected?** Themeisle Orbit Fox <= 3.0.6.

**Is there a fix for CVE-2026-11358?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11358 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11358?** Check whether you run Themeisle Orbit Fox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Orbit Fox plugin for WordPress (versions up to and including 3.0.6) contains a Stored Cross-Site Scripting (XSS) vulnerability within its administrative settings. The root cause is a failure to properly sanitize user input and escape output in the 'menu-icons' module. An authenticated attacker with administrator-level permissions can inject arbitrary JavaScript into the database. This script then executes in the browser of any user accessing the affected administrative pages. The vulnerability specifically impacts WordPress multi-site installations or single-site installations where the 'unfiltered_html' capability has been explicitly disabled for administrators. A patch was introduced in versions following 3.0.6.

## Affected products

- ThemeIsle Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6

## Timeline

- 2026-06-18: disclosed
- 2026-06-18: advisory

## References

- [https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/3.0.5/obfx_modules/menu-icons/init.php](https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/3.0.5/obfx_modules/menu-icons/init.php)
- [https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/3.0.5/obfx_modules/menu-icons/init.php](https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/3.0.5/obfx_modules/menu-icons/init.php)
- [https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/3.0.6/obfx_modules/menu-icons/init.php](https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/3.0.6/obfx_modules/menu-icons/init.php)
- [https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/3.0.6/obfx_modules/menu-icons/init.php](https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/3.0.6/obfx_modules/menu-icons/init.php)
- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3574306%40themeisle-companion&new=3574306%40themeisle-companion&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3574306%40themeisle-companion&new=3574306%40themeisle-companion&sfp_email=&sfph_mail=)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/beb1268c-b680-4ebe-8fe2-65f656390038?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/beb1268c-b680-4ebe-8fe2-65f656390038?source=cve)

## Related threats

- [Orbit Fox WordPress plugin stored XSS in Beaver Builder widget](https://junglewise.ai/threats/cve-2026-85418-orbit-fox-wordpress-plugin-stored-xss-in-beaver-builder-widget)
- [ThemeIsle Orbit Fox Cross Site Scripting](https://junglewise.ai/threats/cve-2026-65563-themeisle-orbit-fox-cross-site-scripting)