# CVE-2026-85418: Orbit Fox WordPress plugin stored XSS in Beaver Builder widget

Source: https://junglewise.ai/threats/cve-2026-85418-orbit-fox-wordpress-plugin-stored-xss-in-beaver-builder-widget  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85418 · Severity: medium · CVSS 5.4 · Published 2026-09-09

The Orbit Fox WordPress plugin provides various page-building and customization features, including integration with Beaver Builder. A contributor-level user can inject malicious HTML attributes into a Pricing Table widget without proper validation. When any visitor views a page containing the affected widget, the injected script executes in their browser, potentially stealing cookies, session tokens, or performing actions on their behalf.

Technologies: [Themeisle Orbit Fox](https://junglewise.ai/threats/technologies/orbit-fox). Vendors: [Themeisle](https://junglewise.ai/threats/vendors/themeisle).

## Quick answers

**Is CVE-2026-85418 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85418 being exploited in the wild.

**How severe is CVE-2026-85418?** Medium severity, with a CVSS score of 5.4, published 9 September 2026.

**Which products and versions are affected?** Themeisle Orbit Fox before 3.0.9.

**Is there a fix for CVE-2026-85418?** A patch was published on 2026-09-09: Fixed in version 3.0.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85418 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85418?** Check whether you run Themeisle Orbit Fox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the Beaver Builder Pricing Table widget of the Orbit Fox plugin. The plugin fails to validate the user-supplied HTML tag name in the plan_title_tag parameter before echoing it into the rendered markup. An authenticated user with contributor-level access or above can craft a malicious tag name (e.g., "h1 onmouseover=alert(document.cookie)") that executes JavaScript when the page is rendered and interacted with by any visitor. The attack requires contributor access to the WordPress site and for Beaver Builder to be active. The vulnerability was fixed in version 3.0.9, which now defaults to safe tags and properly sanitizes the input.

## Affected products

- ThemeIsle Orbit Fox before 3.0.9

## Timeline

- 2026-09-07: disclosed
- 2026-09-09: patched: Fixed in version 3.0.9

## References

- [https://wpscan.com/vulnerability/8f9ba009-324f-46ef-853f-9f2e706c401e/](https://wpscan.com/vulnerability/8f9ba009-324f-46ef-853f-9f2e706c401e/)

## Related threats

- [ThemeIsle Orbit Fox Cross Site Scripting](https://junglewise.ai/threats/cve-2026-65563-themeisle-orbit-fox-cross-site-scripting)
- [ThemeIsle Orbit Fox Stored XSS in admin settings](https://junglewise.ai/threats/cve-2026-11358-themeisle-orbit-fox-stored-xss-in-admin-settings)