Executive brief
The Orbit Fox WordPress plugin provides various page-building and customization features, including integration with Beaver Builder. A contributor-level user can inject malicious HTML attributes into a Pricing Table widget without proper validation. When any visitor views a page containing the affected widget, the injected script executes in their browser, potentially stealing cookies, session tokens, or performing actions on their behalf.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Beaver Builder Pricing Table widget of the Orbit Fox plugin. The plugin fails to validate the user-supplied HTML tag name in the plan_title_tag parameter before echoing it into the rendered markup. An authenticated user with contributor-level access or above can craft a malicious tag name (e.g., "h1 onmouseover=alert(document.cookie)") that executes JavaScript when the page is rendered and interacted with by any visitor. The attack requires contributor access to the WordPress site and for Beaver Builder to be active. The vulnerability was fixed in version 3.0.9, which now defaults to safe tags and properly sanitizes the input.
Affected products
- ThemeIsle Orbit Fox before 3.0.9
Timeline
- 2026-09-07: disclosed
- 2026-09-09: patched: Fixed in version 3.0.9